Security Bulletin: A vulnerability in IBM WebSphere Application Server Liberty affects the IBM Performance Management product (CVE-2017-1194).

Summary

IBM WebSphere Application Server is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

Vulnerability Details

CVEID: CVE-2017-1194**
DESCRIPTION:** IBM WebSphere Application Server is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/123669 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Affected Products and Versions

IBM Monitoring 8.1.3

IBM Application Diagnostics 8.1.3

IBM Application Performance Management 8.1.3

IBM Application Performance Management Advanced 8.1.3

Remediation/Fixes

Product

| Product
VRMF| Remediation
—|—|—
IBM Monitoring

IBM Application Diagnostics

IBM Application Performance Management

IBM Application Performance Management Advanced

| 8.1.3

_ _
_ _| The vulnerability can be remediated by applying the following 8.1.3.0-IBM-IPM-SERVER-IF0011 server patch to the system where the Performance Management server is installed: http://www-01.ibm.com/support/docview.wss?rs=0&uid=isg400003678

The vulnerability can be remediated by applying the following 8.1.3.0-IBM-IPM-GATEWAY-IF0007 Hybrid Gateway patch to the system where the Hybrid Gateway is installed: http://www-01.ibm.com/support/docview.wss?rs=0&uid=isg400003679

Workarounds and Mitigations

None