Security Bulletin:IBM Tivoli Composite Application Manager for Application Diagnostics Installed WebSphere Application Server traditional is vulnerable to Server-Side Request Forgery (CVE-2022-35282)

2022-12-0615:24:55

www.ibm.com

ibm tivoli

application diagnostics

websphere application server

server-side request forgery

cve-2022-35282

vulnerability

remediation

websphere security bulletin

CVSS3

6.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

17.7%

JSON

Summary

The security issue described in CVE-2022-35282 has been identified in the WebSphere Application Server traditional included as part of IBM Tivoli Composite Application Manager for Application Diagnostics

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s)	Version(s)
Tivoli Composite Application Manager for Application Diagnostics	7.1.0

Remediation/Fixes

Follow the WebSphere security bulletin, <https://www.ibm.com/support/pages/node/6824179> to update WebSphere Application Servers.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmtivoli_composite_application_manager_for_wesbsphereMatch7.1.0

VendorProductVersionCPE
ibmtivoli_composite_application_manager_for_wesbsphere7.1.0cpe:2.3:a:ibm:tivoli_composite_application_manager_for_wesbsphere:7.1.0:*:*:*:*:*:*:*