Security Bulletin: Multiple vulnerabilities in WebSphere Application Server bundled with Cloud Pak System and supporting products

Summary

In the WebSphere Application Server Admin console potential cross-site scripting, directory traversal and information disclosure vulnerabilities have been identified. WebSphere Application Server is shipped as a component of IBM Cloud Pak System, and supporting products. Information about security vulnerabilities have been published in security bulletins.

Vulnerability Details

Refer to the security bulletins listed in the Remediation/Fixes section.

Affected Products and Versions

IBM Cloud Pak System v2.2

IBM Cloud Pak System v2.3

Affected Supporting Products

IBM Tivoli Netcool/Omnibus v8.1

IBM Ticoli Monitoring 6.3.0.7

Remediation/Fixes

Refer to the following security bulletins for vulnerability details and information about fixes addressed by supporting products.

CVE |

Affected Supporting Product

|

Supporting Product Security Bulletin

—|—|—

CVE-2019-4442

CVE-2019-4268

CVE-2019-4270

|

IBM WebSphere Application Server Version 8.5, and 9.0.

|

Security Bulletin: Path traversal vulnerability in WebSphere Application Server Admin Console (CVE-2019-4442)

Security Bulletin: File traversal vulnerability in WebSphere Application Server Admin Console (CVE-2019-4268)

Security Bulletin: Cross-site scripting vulnerability in WebSphere Application Server Admin Console (CVE-2019-4270)

CVE-2019-4477 | Netcool /Omnibus 8.1 |

A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool/OMNIbus WebGUI (CVE-2019-4477)

CVE-2019-0220
CVE-2019-10098
CVE-2019-10092
CVE-2018-20843
CVE-2019-4080
CVE-2019-4441
CVE-2019-4477
CVE-2019-4046
CVE-2019-4268
CVE-2019-4270
CVE-2019-4442 | Tivoli Monitoring 6.3 | IBM Security Bulletin Tivoli Monitoring

Workarounds and Mitigations

None.