PT-2023-13701 · Ibm · Ibm Websphere Application Server Liberty+2

Published 2023-05-03 · Updated 2025-03-03 · CVE-2022-39161

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 9.0 IBM WebSphere Application Server Liberty

Description The issue allows an authenticated user to conduct spoofing attacks when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server. A man-in-the-middle attacker could exploit this using a certificate issued by a trusted authority to obtain sensitive information.

Recommendations For IBM WebSphere Application Server versions 7.0 through 9.0, update to a version that includes the fix for this issue. For IBM WebSphere Application Server Liberty, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Web Server Plug-ins for IBM WebSphere Application Server to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-39161

Affected Products

Ibm Websphere Application Server

Ibm Websphere Application Server Liberty

Web Server Plug-Ins For Ibm Websphere Application Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-39161 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39161 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/235069 · Vendor Advisory
• https://ibm.com/support/pages/node/6987779 · Vendor Advisory
• https://t.me/cvenotify/49750 · Telegram Post
• https://t.me/cvenotify/50111 · Telegram Post
• https://t.me/cibsecurity/63250 · Telegram Post
• https://twitter.com/knaepp/status/1896591408917631474 · Twitter Post