Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM815FDCBFAE66C75DEDB6602B0644764EAB6272FD284BD0ACE9ECE2933CD4EEBF
HistoryApr 10, 2024 - 6:58 p.m.

Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are vulnerable to a denial of service due to jose4j (CVE-2023-51775)

2024-04-1018:58:19
www.ibm.com
12
ibm cloud pak
websphere application server
ibm cloud pak for applications
jose4j library
denial of service
vulnerability
ibm
apar ph60199
apar ph60195

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.9

Confidence

High

EPSS

0

Percentile

9.0%

JSON

Summary

There is a vulnerability in the jose4j library used by IBM WebSphere Application Server traditional and used by the IBM WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s) and Version(s) Affecting Product(s) and Version(s) Affecting Product(s) and Version(s)

IBM Cloud Pak for Applications

  • 5.1
    |

IBM WebSphere Application Server Liberty

  • 21.0.0.3 - 24.0.0.3
    |

IBM WebSphere Application Server

  • 9.0
  • 8.5

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the APAR PH60199 and APAR PH60195 as described in Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to a denial of service due to jose4j (CVE-2023-51775)

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmcloud_pak_for_applicationsMatch5.1
VendorProductVersionCPE
ibmcloud_pak_for_applications5.1cpe:2.3:a:ibm:cloud_pak_for_applications:5.1:*:*:*:*:*:*:*

Related

prion 1
vulnrichment 1
ibm 59
cvelist 1
debiancve 1
osv 3
nessus 4
nvd 1
veracode 1
github 1
wolfi 1
ubuntucve 1
cgr 1
redhatcve 1
cve 1
redhat 6
oracle 2
prion
prion
Design/Logic Flaw
2024-02-29 01:42:00
vulnrichment
vulnrichment
CVE-2023-51775
2023-12-25 00:00:00
ibm
ibm
Security Bulletin: Maximo Application Suite - IBM WebSphere Application Server Liberty is vulnerable to CVE-2023-51775 a denial of service due to jose4j
2024-08-09 11:19:56
Security Bulletin: Denial of Service vulnerability in WebSphere Liberty affects IBM Business Automation Workflow - CVE-2023-51775
2024-06-03 11:27:21
Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Buinses Automation Workflow (CVE-2023-51775)
2024-04-10 11:45:13
cvelist
cvelist
CVE-2023-51775
2023-12-25 00:00:00
debiancve
debiancve
CVE-2023-51775
2024-02-29 01:42:05
osv
osv
CVE-2023-51775
2024-02-29 01:42:05
CGA-gw52-mj78-8v54
2024-06-06 12:27:33
jose4j denial of service via specifically crafted JWE
2024-02-29 03:33:14
nessus
nessus
SUSE SLES15 Security Update : SUSE Manager Server 4.3 (SUSE-SU-2024:1532-1)
2024-05-07 00:00:00
SUSE SLES15 Security Update : SUSE Manager Server 4.3 (SUSE-SU-2024:1507-1)
2024-05-07 00:00:00
IBM WebSphere Application Server 8.5.5.3 < 8.5.5.26 / 9.x < 9.0.5.20 / Liberty 21.0.0.3 < 24.0.0.4 DoS (7145942)
2024-04-04 00:00:00
nvd
nvd
CVE-2023-51775
2024-02-29 01:42:05
veracode
veracode
Denial Of Service (DoS)
2024-03-05 06:37:59
github
github
jose4j denial of service via specifically crafted JWE
2024-02-29 03:33:14
wolfi
wolfi
CVE-2023-51775 vulnerabilities
2024-05-29 03:07:31
ubuntucve
ubuntucve
CVE-2023-51775
2024-02-29 00:00:00
cgr
cgr
CVE-2023-51775 vulnerabilities
2024-05-19 03:07:16
redhatcve
redhatcve
CVE-2023-51775
2024-02-29 09:03:19
cve
cve
CVE-2023-51775
2024-02-29 01:42:05
redhat
redhat
(RHSA-2024:4386) Moderate: Red Hat JBoss EAP 7.4.17 XP 4.0.2 security release
2024-07-08 20:03:26
(RHSA-2024:4392) Important: Red Hat JBoss Enterprise Application Platform 8.0.2 Security update
2024-07-08 22:17:51
(RHSA-2024:3550) Important: HawtIO 4.0.0 for Red Hat build of Apache Camel 4 Release and security update.
2024-06-03 11:50:58
oracle
oracle
Oracle Critical Patch Update Advisory - July 2024
2024-07-16 00:00:00
Oracle Critical Patch Update Advisory - April 2024
2024-04-16 00:00:00

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.9

Confidence

High

EPSS

0

Percentile

9.0%

JSON
Related for 815FDCBFAE66C75DEDB6602B0644764EAB6272FD284BD0ACE9ECE2933CD4EEBF
prion1vulnrichment1ibm59cvelist1debiancve1osv3nessus4nvd1veracode1github1wolfi1ubuntucve1cgr1redhatcve1cve1redhat6oracle2