Security Bulletin: Security vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2019-4442, CVE-2019-4271, CVE-2019-4268, CVE-2019-4270 and CVE-2019-4477)

Summary

WebSphere Application Server is shipped as a component of WebSphere Service Registry and Repository. Information about security vulnerabilities affecting WebSphere Application Server have been published in security bulletins.

Vulnerability Details

Refer to the following security bulletins for vulnerability details and information about fixes:

• Security Bulletin: Path traversal vulnerability in WebSphere Application Server Admin Console (CVE-2019-4442)
• Security Bulletin: HTTP Parameter Pollution and XSS vulnerability in WebSphere Application Server Admin Console ND (CVE-2019-4271)
• Security Bulletin: File traversal vulnerability in WebSphere Application Server Admin Console (CVE-2019-4268)
• Security Bulletin: Cross-site scripting vulnerability in WebSphere Application Server Admin Console (CVE-2019-4270)
• Security Bulletin: Information disclosure vulnerability in WebSphere Application Server (CVE-2019-4477)

Affected Products and Versions

WebSphere Service Registry and Repository V8.0 and V8.5 are affected.

Remediation/Fixes

Principal Product and Version(s)

|

Affected Supporting Product and Version

—|—

WebSphere Service Registry and Repository V8.5

|

WebSphere Application Server V8.5.5

WebSphere Service Registry and Repository V8.0

|

WebSphere Application Server V8.0

Note the following Flash before upgrading WebSphere Application Server:

WebSphere Service Registry and Repository: Read First before upgrading to WebSphere Application Server V8.5.5 Fix Pack 14

Workarounds and Mitigations

None