Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMA10A81FCA123ABD51C6EDC335DDB49CE3FC626C9476125C2CC265D2F157F0C97
HistoryJun 17, 2018 - 10:33 p.m.

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Cloud Orchestrator and Cloud Orchestrator Enterprise (CVE-2016-0385)

2018-06-1722:33:15
www.ibm.com
8

3.1 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

JSON

Summary

IBM WebSphere Application Server and IBM Business Process Manage are shipped with IBM Cloud Orchestrator and Cloud Orchestrator Enterprise.
Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin.

Vulnerability Details

Consult Security Bulletin: Bypass security restrictions in WebSphere Application Server (CVE-2016-0385) for information details.

Affected Products and Versions

Principal Product and Version(s)

| Affected Supporting Product and Version
—|—
IBM Cloud Orchestrator V2.5, V2.5.0.1, V2.5.0.2|

  • WebSphere Application Server V8.5.5 through V8.5.5.7

  • IBM Business Process Manager Standard V8.5.5 - V8.5.6.2
    IBM Cloud Orchestrator V2.4, V2.4.01, V2.4.0.2,V2.4.0.3|

  • WebSphere Application Server V8.5.0.1 through V8.5.5.7

  • IBM Business Process Manager Standard V8.5.0.1
    IBM Cloud Orchestrator V2.3, V2.3.0.1|

  • IBM WebSphere Application Server V8.0, V8.0.11

  • IBM Business Process Manager Standard V8.5.0.1
    IBM Cloud Orchestrator Enterprise V2.5, V2.5.0.1, V2.5.0.2 |

  • WebSphere Application Server V8.5.5 through V8.5.5.7

  • IBM Business Process Manager Standard V8.5.5 - V8.5.6.2

  • IBM SmartCloud Cost Management V2.1.0.5
    IBM Cloud Orchestrator Enterprise V2.4, V2.4.01, V2.4.0.2,V2.4.0.3|

  • WebSphere Application Server V8.5.0.1 through V8.5.5.7

  • IBM Business Process Manager Standard V8.5.0.1

  • IBM SmartCloud Cost Management V2.1.0.4
    IBM Cloud Orchestrator Enterprise V2.3, V2.3.0.1|

  • IBM WebSphere Application Server V8.0, V8.0.11

  • IBM Business Process Manager Standard V8.5.0.1

  • IBM SmartCloud Cost Management V2.1.0.3

Remediation/Fixes

Refer to the following security bulletins for vulnerability details and information about fixes addressed by IBM WebSphere Application Server which is shipped with IBM Cloud Orchestrator.

Principal Product and Version(s) Affected Supporting Product and Version Affected Supporting Product Security Bulletin
IBM Cloud Orchestrator V2.5, V2.5.0.1, V2.5.0.2,

Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Business Process Manager, WebSphere Process Server, WebSphere Dynamic Process Edition, and WebSphere Lombardi Edition
IBM Cloud Orchestrator V2.4, V2.4.01, V2.4.0.2,V2.4.0.3|

  • WebSphere Application Server V8.5.0.1 through V8.5.5.7

  • IBM Business Process Manager Standard V8.5.0.1
    IBM Cloud Orchestrator V2.3, V2.3.0.1|

  • IBM WebSphere Application Server V8.0, V8.0.11

  • IBM Business Process Manager Standard V8.5.0.1
    IBM Cloud Orchestrator Enterprise V2.5, V2.5.0.1, V2.5.0.2 |

  • WebSphere Application Server V8.5.5 through V8.5.5.7

  • IBM Business Process Manager Standard V8.5.5 - V8.5.6.2

  • IBM SmartCloud Cost Management V2.1.0.5
    IBM Cloud Orchestrator Enterprise V2.4, V2.4.01, V2.4.0.2,V2.4.0.3|

  • WebSphere Application Server V8.5.0.1 through V8.5.5.7

  • IBM Business Process Manager Standard V8.5.0.1

  • IBM SmartCloud Cost Management V2.1.0.4
    IBM Cloud Orchestrator Enterprise V2.3, V2.3.0.1|

  • IBM WebSphere Application Server V8.0, V8.0.11

  • IBM Business Process Manager Standard V8.5.0.1

  • IBM SmartCloud Cost Management V2.1.0.3

Workarounds and Mitigations

Apply mitigation as per Security Bulletin WebSphere Application Server (CVE-2016-0385).

Related

ibm 36
nessus 2
cve 1
prion 1
openvas 1
ibm
ibm
Security Bulletin:Potential bypass security in WebSphere Applicaiton Server in IBM eDiscovery Manager
2018-06-17 12:17:10
Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Financial Transaction Manager (CVE-2016-0385)
2018-06-16 20:05:02
Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Partner Gateway Advanced/Enterprise Edition(CVE-2016-0385)
2018-06-16 20:04:31
nessus
nessus
IBM WebSphere Application Server 7.0 < 7.0.0.43 / 8.0 < 8.0.0.13 / 8.5 < 8.5.5.10 / 9.0 < 9.0.0.1 / Liberty 16.0 < 16.0.0.3 Information Disclosure
2016-11-07 00:00:00
IBM WebSphere Application Server 7.0 < 7.0.0.41 Multiple Vulnerabilities
2016-10-26 00:00:00
cve
cve
CVE-2016-0385
2016-09-01 10:59:00
prion
prion
Buffer overflow
2016-09-01 10:59:00
openvas
openvas
IBM Websphere Application Server 'HttpSessionIdReuse' Information Disclosure Vulnerability
2016-09-06 00:00:00

3.1 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

JSON
Related for A10A81FCA123ABD51C6EDC335DDB49CE3FC626C9476125C2CC265D2F157F0C97
ibm36nessus2cve1prion1openvas1