Security Bulletin: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202.

Summary

Copy Services Manager is dependant on the capabilities of IBM Websphere application server versions that have been identified by this CVE. CSM version 6.3.1 and earlier versions ship with the versions that have been identified as having this weakness. CSM version 6.3.2 contains an updated version of WebSphere Liberty which has a fix for the CVE.

Vulnerability Details

CVEID:CVE-2021-29842
**DESCRIPTION:**IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/205202 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Upgrade to Copy Services Manager 6.3.2 to pick up the fix.

Workarounds and Mitigations

None