PT-2020-18073 · Ibm · Ibm Websphere Application Server

Tint0 · Published 2020-06-05 · Updated 2021-07-21 · CVE-2020-4449

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 9.0

Description The issue allows a remote attacker to obtain sensitive information with a specially-crafted sequence of serialized objects. This is related to the deserialization of untrusted data, which can lead to information disclosure.

Recommendations For IBM WebSphere Application Server versions 7.0 through 9.0, consider restricting access to the IIOP protocol to minimize the risk of exploitation until a patch is available. As a temporary workaround, disabling the deserialization of untrusted data can help mitigate the issue.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-4449

ZDI-20-690

Affected Products

Ibm Websphere Application Server

References · 6

• https://ibm.com/support/pages/node/6220296 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4449 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/181230 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-20-690 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-4449 · Security Note
• https://t.me/cybersecuritytechnologies/1463 · Telegram Post