Security Bulletin: Vulnerability in WebSphere Application Server Liberty affects IBM Z Development and Test Environment - Jan 2021

2021-01-2914:27:17

www.ibm.com

EPSS

0.001

Percentile

49.7%

JSON

Summary

There is a vulnerability in WebSphere Application Server Liberty that is used by IBM Z Development and Test Environment. The issue affects WebSphere Application Server Liberty 17.0.0.3 - 20.0.0.10 using the beanValidation-2.0 feature.

Vulnerability Details

CVEID:CVE-2020-10693
**DESCRIPTION:**Hibernate Hibernate Validator could allow a remote attacker to bypass security restrictions, caused by a flaw in the message interpolation processor. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass input sanitation controls when handling user-controlled data in error messages.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/182240 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
Z Development & Test Environment	All

Remediation/Fixes

For all versions, update the currently installed ZD&T Enterprise Edition to v12.0.5.2 or v13.0.1. For instructions on installing this update using Installer, review the topic in the Updating Enterprise Edition IBM Knowledge Center. For the latest updates, see also the Fix list for IBM Z Development and Test Environment.