Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM3B14EF39E23ED5D5A8D961DD2CB7B420FE08663F3A64A5857C77E2393E783EF9
HistoryMar 26, 2021 - 12:04 p.m.

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Business Service Manager (CVE-2021-20353)

2021-03-2612:04:47
www.ibm.com
11

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

JSON

Summary

IBM WebSphere Application Server is shipped as a component of Tivoli Business Service Manager. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Principal Product and Version(s) Affected Supporting Product and Version
Tivoli Business Service Manager 6.2 IBM WebSphere Application Server 8.5

Remediation/Fixes

Principal Product and Version(s) Affected Supporting Product and Version
Tivoli Business Service Manager 6.2 Security Bulletin: WebSphere Application Server is vulnerable to an XML External Entity (XXE) Injection vulnerability (CVE-2021-20353)

For IBM WebSphere Application Server V8.5.0.0 through 8.5.5.19:

  • Upgrade to minimal fix pack levels as required by the interim fix and then apply Interim Fix PH33228
  • Apply Fix Pack 8.5.5.19 or later.

Workarounds and Mitigations

None

Related

nessus 1
ibm 31
prion 1
cve 1
cvelist 1
zdi 1
nessus
nessus
IBM WebSphere Application Server 7.0.0.x <= 7.0.0.45 / 8.0.0.x <= 8.0.0.15 / 8.5.x <= 8.5.5.19 / 9.0.x <= 9.0.5.6 XXE (6413709)
2021-02-25 00:00:00
ibm
ibm
Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Remote Server (CVE-2021-20353)
2021-02-18 21:43:21
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool/OMNIbus WebGUI (CVE-2021-20353)
2021-03-02 01:20:14
Security Bulletin: Embedded WebSphere Application Server is vulnerable to an XML External Entity (XXE) Injection vulnerability affects Content Collector for Email
2021-04-27 13:42:14
prion
prion
Xxe
2021-02-10 17:15:00
cve
cve
CVE-2021-20353
2021-02-10 17:15:00
cvelist
cvelist
CVE-2021-20353
2021-02-09 00:00:00
zdi
zdi
IBM WebSphere EDataGraphImpl Deserialization of Untrusted Data Information Disclosure Vulnerability
2021-02-10 00:00:00

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

JSON
Related for 3B14EF39E23ED5D5A8D961DD2CB7B420FE08663F3A64A5857C77E2393E783EF9
nessus1ibm31prion1cve1cvelist1zdi1