PT-2018-14050 · Ibm · Ibm Websphere Application Server Liberty

Published 2018-08-24 · Updated 2019-10-09 · CVE-2018-1755

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server Liberty (affected versions not specified)

Description The issue is caused by incorrect transport being used when Liberty is configured to use Java Authentication SPI for Containers (JASPIC), allowing a remote attacker to obtain sensitive information. This can occur when the Application Server is configured to permit access on non-secure (http) port and is using JASPIC or JSR375 authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-1755

Affected Products

Ibm Websphere Application Server Liberty

References · 5

• https://ibm.com/support/docview.wss?uid=ibm10728689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1755 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/148597 · Vendor Advisory
• http://securityfocus.com/bid/105150 · Note
• http://securitytracker.com/id/1041558 · Note