IBM8B5E55715CB43CFD48BB9D471BB81630C46627FBD2947452B93068127B46D7EDSecurity Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway (CVE-2016-0359)
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
Summary
IBM WebSphere Application Server is shipped as a component of IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin.
Vulnerability Details
Please consult the security bulletin, Security Bulletin: HTTP Response Splitting in WebSphere Application Server (CVE-2016-0359), for vulnerability details and information about fixes.
Affected Products and Versions
| Principal Product and Version(s) | Affected Supporting Product and Version |
|---|---|
| IBM Tivoli Federated Identity Manager 6.2.1 | |
| IBM Tivoli Federated Identity Manager Business Gateway 6.2.1 | IBM WebSphere Application Server 7.0 |
| IBM Tivoli Federated Identity Manager 6.2.2 | |
| IBM Tivoli Federated Identity Manager Business Gateway 6.2.2 | IBM WebSphere Application Server 7.0, 8.0, 8.5 |
Remediation/Fixes
IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway are affected through IBM WebSphere Application Server. If you use one of the affected versions of WebSphere, update your IBM WebSphere Application Server with the appropriate Interim Fix based on information in the WebSphere security bulletin, Security Bulletin: HTTP Response Splitting in WebSphere Application Server (CVE-2016-0359).
| CPE | Name | Operator | Version |
|---|---|---|---|
| tivoli federated identity manager | eq | 6.2.1 | |
| tivoli federated identity manager | eq | 6.2.2 |
Related
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N