Lucene search

K
ibmIBM15E2989FC741ED3FAB7F64ACB52BD02332B6D35365B6326FB2B75CEE510A11E1
HistoryDec 17, 2019 - 10:47 p.m.

Security Bulletin: Multiple vulnerabilities in IBM WebSphere affect IBM Control Center (CVE-2016-0283, CVE-2015-7417).

2019-12-1722:47:42
www.ibm.com
5

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

53.9%

Summary

IBM WebSphere Application Server is shipped as a component of IBM Control Center. Multiple vulnerabilities have been addressed.

Vulnerability Details

CVEID: CVE-2016-0283**
DESCRIPTION:** IBM WebSphere Application Server is vulnerable to cross-site scripting in the OIDC client web application caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute a script in a victim’s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base Score: 6.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111229 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

CVEID: CVE-2015-7417**
DESCRIPTION:** IBM WebSphere Application Server is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute a script in a victim’s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/107575 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

IBM Control Center 6.1.0.0 through 6.1.0.0 iFix01
IBM Control Center 6.0.0.0 through 6.0.0.1 iFix04
IBM Sterling Control Center 5.4.2 through 5.4.2.1 iFix07

Remediation/Fixes

Product

| VRMF|Fix|How to acquire fix
—|—|—|—
IBM Control Center| 6.1.0.0| iFix02| Fix Central - 6.1.0.0
IBM Control Center| 6.0.0.1| iFix05| Fix Central - 6.0.0.1
Sterling Control Center| 5.4.2.1| iFix08| Fix Central - 5.4.2.1

Workarounds and Mitigations

None.

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

53.9%

Related for 15E2989FC741ED3FAB7F64ACB52BD02332B6D35365B6326FB2B75CEE510A11E1