9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.003 Low
EPSS
Percentile
65.8%
There is a vulnerability in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server. The CVE(s) listed in this document might affect some configurations of IBM WebSphere Application Server traditional . This product has addressed the applicable CVE. If you run your own Java code using the IBM Java Runtime delivered with this product, you should evaluate your code to determine whether this vulnerability is applicable to your code. Refer to the link for “IBM Java SDK Security Bulletin” located in the References section for more information.
CVEID:CVE-2022-40609
**DESCRIPTION:**IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 236069.
CVSS Base score: 8.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/236069 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Product(s) | Version(s) |
---|---|
IBM WebSphere Application Server | 9.0 |
IBM WebSphere Application Server | 8.5 |
For Version 9 IBM WebSphere Application Server traditional:
Update to the IBM SDK, Java Technology Edition, Version 8 Service Refresh 8 FP5 using the instructions in the IBM Documentation Installing and updating IBM SDK, Java Technology Edition on distributed environments then use the IBM Installation Manager to access the online product repositories to install the SDK or use IBM Installation Manager and access the packages from Fixcentral.
For Version 8.5.0.0 through 8.5.5.23 IBM WebSphere Application Server traditional:
For the IBM SDK, Java Technology Version that you use, upgrade to the minimal fix pack level of IBM WebSphere Application Server as noted in the interim fix below then apply the interim fixes:
For IBM SDK Java Technology Edition Version 8
OR
For Application Client for IBM WebSphere Application Server:
Follow instructions above for the IBM WebSphere Application Server to download the interim fix needed for your version of the Application Client.
None
CPE | Name | Operator | Version |
---|---|---|---|
websphere application server | eq | 9.0 | |
websphere application server | eq | 8.5 |
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.003 Low
EPSS
Percentile
65.8%