Lucene search

IBM8C3A6A108134026500BBE9761C55BF5A6E9F6CD18A1A022A004D5EC473A1853F

HistoryMar 30, 2023 - 5:24 p.m.

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to cross-site scripting in the Admin Console (CVE-2023-26283)

2023-03-3017:24:32

www.ibm.com

ibm websphere hybrid edition

cross-site scripting

admin console

cve-2023-26283

fix pack

apar ph52925

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.0005 Low

EPSS

Percentile

18.2%

JSON

Summary

IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to cross-site scripting in the Admin Console (CVE-2023-26283)

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s) and Version(s)	Affecting Product(s) and Version(s)

IBM WebSphere Hybrid Edition

5.1
| | IBM WebSphere Application Server

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the APAR PH52925 as described in Security Bulletin: IBM WebSphere Application Server is vulnerable to cross-site scripting in the Admin Console (CVE-2023-26283).

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmwebsphereMatch5.1

CPENameOperatorVersion
ibm websphere hybrid editioneq5.1

CPE	Name	Operator	Version
	ibm websphere hybrid edition	eq	5.1