Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM476B017015C7BC4F8F39C2B41A3D687C1FD9E58B44A524C0A4CF05B7ED875145
HistoryOct 07, 2020 - 9:32 p.m.

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with Tivoli Access Manager for e-business

2020-10-0721:32:45
www.ibm.com
9

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

JSON

Summary

IBM WebSphere Application Server is shipped with Tivoli Access Manager for e-business. Information about security vulnerabilities affecting IBM WebSphere Application Server have been published in a security bulletin

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s)

|

Version(s)

—|—

IBM Tivoli Access Manager for e-business

|

6.1.1.x

IBM Tivoli Access Manager for e-business

|

6.1.x

Remediation/Fixes

Principal Product and Versions Affected Supporting Product and Versions Affected Supporting Product Security Bulletins
IBM Tivoli Access Manager for e-business 6.1.x, 6.1.1.x IBM WebSphere Application Server 7.0, 8.0 Security Bulletin: WebSphere Application Server ND is vulnerable to cross-site scripting (CVE-2020-4575)

Security Bulletin: Remote code execution vulnerability in WebSphere Application Server ND (CVE-2020-4448)

Security Bulletin: WebSphere Application Server is vulnerable to a remote code execution vulnerability (CVE-2020-4589)

Security Bulletin: WebSphere Application Server is vulnerable to a remote code execution vulnerability (CVE-2020-4464)

Security Bulletin: WebSphere Application Server is vulnerable to a remote code execution vulnerability (CVE-2020-4534)

Security Bulletin: Vulnerability in Apache Batik affects WebSphere Application Server (CVE-2019-17566)

Security Bulletin: WebSphere Application Server Admin Console is vulnerable to cross-site scripting (CVE-2020-4578)

Security Bulletin: WebSphere Application Server is vulnerable to a remote code execution vulnerability (CVE-2020-4450)

Security Bulletin: WebSphere Application Server is vulnerable to an information disclosure vulnerability (CVE-2020-4576)

Security Bulletin: WebSphere Application Server is vulnerable to an information exposure vulnerability (CVE-2020-4643)

Security Bulletin: WebSphere Application Server is vulnerable to an information disclosure vulnerability (CVE-2020-4629)

Security Bulletin: Privilege Escalation Vulnerability in WebSphere Application Server (CVE-2020-4362)

Workarounds and Mitigations

None

Related

ibm 167
githubexploit 1
nessus 6
cve 7
prion 7
osv 2
zdi 1
suse 2
debiancve 1
ubuntucve 1
redhatcve 1
veracode 1
openvas 1
github 1
ibm
ibm
Security Bulletin: Vulnerabilities in WebSphere Application Server affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise
2020-09-29 09:51:50
Security Bulletin: Multiple security vulnerabilities in WebSphere Application Server affect Predictive Maintenance and Quality and Predictive Maintenance Insights
2020-10-19 15:09:06
Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Tivoli Federated Identity Manager
2020-12-09 16:14:35
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Ibm Websphere Application Server
2021-08-17 08:44:49
nessus
nessus
IBM WebSphere Application Server 7.0.0.x <= 7.0.0.45 / 8.0.0.x <= 8.0.0.15 / 8.5.x <= 8.5.5.18 / 9.0.x <= 9.0.5.5 Information Disclosure (6339255)
2021-01-19 00:00:00
IBM WebSphere Application Server 7.0.0.x <= 7.0.0.45 / 8.0.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.17 / 9.0.x < 9.0.5.4 RCE (6258333)
2020-08-27 00:00:00
openSUSE Security Update : xmlgraphics-batik (openSUSE-2020-851)
2020-07-20 00:00:00
cve
cve
CVE-2020-4629
2020-09-30 15:15:00
CVE-2020-4589
2020-08-13 12:15:00
CVE-2020-4464
2020-07-17 14:15:00
prion
prion
Code injection
2020-08-13 12:15:00
Privilege escalation
2020-04-10 14:15:00
Information disclosure
2020-09-30 15:15:00
osv
osv
CVE-2019-17566
2020-11-12 18:15:12
Server-side request forgery (SSRF) in Apache Batik
2022-02-09 00:46:46
zdi
zdi
IBM WebSphere Application Server SOAP Deserialization of Untrusted Data Remote Code Execution Vulnerability
2020-07-20 00:00:00
suse
suse
Security update for xmlgraphics-batik (moderate)
2020-06-23 00:00:00
Security update for xmlgraphics-batik (moderate)
2020-07-23 00:00:00
debiancve
debiancve
CVE-2019-17566
2020-11-12 18:15:00
ubuntucve
ubuntucve
CVE-2019-17566
2020-11-12 00:00:00
redhatcve
redhatcve
CVE-2019-17566
2020-06-18 15:55:19
veracode
veracode
Server-side Request Forgery (SSRF)
2020-06-16 09:19:33
openvas
openvas
openSUSE: Security Advisory for xmlgraphics-batik (openSUSE-SU-2020:0851-1)
2020-06-23 00:00:00
github
github
Server-side request forgery (SSRF) in Apache Batik
2022-02-09 00:46:46

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

JSON
Related for 476B017015C7BC4F8F39C2B41A3D687C1FD9E58B44A524C0A4CF05B7ED875145
ibm167githubexploit1nessus6cve7prion7osv2zdi1suse2debiancve1ubuntucve1redhatcve1veracode1openvas1github1