Lucene search

IBM339329651D96576DC60D7107F5B53ACD3DCCBC6B28BDCB6036B57E792819BC11

HistoryJun 26, 2024 - 2:53 p.m.

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to cross-site scripting (CVE-2024-35153)

2024-06-2614:53:13

www.ibm.com

ibm

websphere

application server

hybrid edition

cross-site scripting

vulnerability

cve-2024-35153

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

5.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Summary

IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to cross-site scripting in the administrative console.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s) and Version(s)	Affecting Product(s) and Version(s)

IBM WebSphere Hybrid Edition

5.1
|

IBM WebSphere Application Server

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the APAR PH61546. as described in Security Bulletin: IBM WebSphere Application Server is vulnerable to cross-site scripting (CVE-2024-35153).

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmwebsphereMatch5.1

CPENameOperatorVersion
ibm websphere hybrid editioneq5.1

CPE	Name	Operator	Version
	ibm websphere hybrid edition	eq	5.1