Security Bulletin: Code execution vulnerability in IBM MessageSight (CVE-2016-5983)

Summary

There is a potential code execution vulnerability in WebSphere Application Server Liberty Profile used by IBM MessageSight

Vulnerability Details

CVEID: CVE-2016-5983 DESCRIPTION: IBM WebSphere Application Server could allow remote attackers to execute arbitrary Java code with a serialized object from untrusted sources.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/116468&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

IBM MessageSight 1.1 – 2.0

Remediation/Fixes

Product

|
VRMF|
APAR|
Remediation/First Fix
—|—|—|—
IBM MessageSight| 1.1| IT18441| 1.1.0.1-IBM-IMA-IF****IT18441

IBM MessageSight|
1.2| IT18441| 1.2.0.3-IBM-IMA-IF****IT18441
IBM MessageSight| 2.0| IT18441| 2.0.0.1-IBM-IMA-IF****IT18441

Workarounds and Mitigations

None