Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM WebSphere Remote Server CVE-2024-35153

2024-08-1520:01:54

www.ibm.com

ibm

websphere

remote server

vulnerability

security bulletin

cross-site scripting

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

JSON

Summary

IBM WebSphere Application Server is shipped with IBM WebSphere Remote Server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s)	Version(s)
IBM WebSphere Remote Server - Product Family	9.1, 9.0, 8.5

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now. Refer to the following security bulletins for vulnerability details and information about fixes addressed by WebSphere Application Server which is shipped with IBM WebSphere Remote Server.

Principal Product and Version(s)

Affected Supporting Product and Version

Affected Supporting Product Security Bulletin

—|—|—

IBM WebSphere Remote Server 9.1, 9.0, 8.5

WebSphere Application 9.0, 8.5

IBM WebSphere Application Server is vulnerable to cross-site scripting (CVE-2024-35153)

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmwebsphere_remote_serverMatch9.1

ibmwebsphere_remote_serverMatch9.0

ibmwebsphere_remote_serverMatch8.5

VendorProductVersionCPE
ibmwebsphere_remote_server9.1cpe:2.3:a:ibm:websphere_remote_server:9.1:*:*:*:*:*:*:*
ibmwebsphere_remote_server9.0cpe:2.3:a:ibm:websphere_remote_server:9.0:*:*:*:*:*:*:*
ibmwebsphere_remote_server8.5cpe:2.3:a:ibm:websphere_remote_server:8.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	websphere_remote_server	9.1	cpe:2.3:a:ibm:websphere_remote_server:9.1:::::::*
ibm	websphere_remote_server	9.0	cpe:2.3:a:ibm:websphere_remote_server:9.0:::::::*
ibm	websphere_remote_server	8.5	cpe:2.3:a:ibm:websphere_remote_server:8.5:::::::*