Security Bulletin: Vulnerability in IBM WebSphere eXtreme Scale Liberty Deployment could expose sensitive information.

Summary

Vulnerability in IBM WebSphere eXtreme Scale Liberty Deployment could expose sensitive information.

Vulnerability Details

CVEID:CVE-2020-4336
**DESCRIPTION:**IBM WebSphere Extreme Scale stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/177932 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

For new installation, this vulnerability is fixed in 8.6.1.4

For existing installation / upgrade please follow the steps in Workaround and mitigations section.

Workarounds and Mitigations

Add the following entry in RestAdmin server.xml located at <XSLD_HOME>\wlp\usr\servers\restAdminServer

and RestData server.xml located at <XSLD_HOME>\wlp\usr\servers\restDataServer

<!-- Set the WASReqURL cookie to be secure –>

<webAppSecurity ssoRequiresSSL=“true”/>

<httpSession cookieSecure=“true”/>