PT-2024-20705 · Ibm · Ibm Websphere Application Server+1

Published 2024-04-25 · Updated 2024-04-25 · CVE-2024-25026

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 8.5 through 9.0 IBM WebSphere Application Server Liberty versions 17.0.0.3 through 24.0.0.4

Description The issue is caused by sending a specially crafted request, which could lead to a denial of service. A remote attacker could exploit this to cause the server to consume memory resources.

Recommendations For IBM WebSphere Application Server versions 8.5 through 9.0, update to a version that is not affected by this issue. For IBM WebSphere Application Server Liberty versions 17.0.0.3 through 24.0.0.4, update to a version that is not affected by this issue. As a temporary workaround, consider restricting access to the server to minimize the risk of exploitation.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2024-25026

Affected Products

Ibm Websphere Application Server

Ibm Websphere Application Server Liberty

References · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/281516 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25026 · Vendor Advisory
• https://ibm.com/support/pages/node/7149330 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25026 · Security Note