PT-2020-18080 · Ibm · Ibm Websphere Application Server

Tint0 · Published 2020-07-17 · Updated 2020-10-01 · CVE-2020-4464

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 9.0

Description The issue allows a remote attacker to execute arbitrary code on a system with a specially-crafted sequence of serialized objects over the SOAP connector. This is related to the deserialization of untrusted data.

Recommendations For versions 7.0 through 9.0, as a temporary workaround, consider disabling the SOAP connector until a patch is available. Restrict access to the SOAP endpoint to minimize the risk of exploitation. Avoid using untrusted data in the deserialization process until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-4464

ZDI-20-878

Affected Products

Ibm Websphere Application Server

References · 7

• 🔥 https://github.com/silentsignal/WebSphere-WSIF-gadget · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/181489 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-20-878 · Security Note
• https://osv.dev/vulnerability/CVE-2020-4464 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4464 · Security Note
• https://ibm.com/support/pages/node/6250059 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/1841 · Telegram Post