7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server 8.5.5.6, IBM WebSphere Application Server Hypervisor 8.5.5.6 and IBM WebSphere Application Server Liberty Profile 8.5.5.6.
CVEID: CVE-2015-0226**
DESCRIPTION:** Apache WSS4J could allow a remote attacker to obtain sensitive information, caused by Bleichenbacher’s attack on XML Encryption. By sending a specially-crafted message, an attacker could exploit this vulnerability to decrypt the key and obtain sensitive information.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100836 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
**
Remediation/Fixes: The recommended solution is to apply the Interim Fix, Fix Pack, or PTF for each named product as soon as practical._
Fix:_**
Apply an Interim Fix, Fix Pack or PTF containing this APAR PI36866, as noted below:
**For IBM WebSphere Application Server Liberty profile:
For V8.5.5.2 through 8.5.5.5:**
-- OR
** Workaround(s): None known_
Mitigation(s):_** None known
CVE ID:CVE-2015-1885(APAR PI33202 and PI36211) **
DESCRIPTION: WebSphere Application Server Full Profile and Liberty Profile could allow a remote attacker to gain elevated privileges on the system when OAuth grant type of password is used.
CVSS:** _
CVSS Base Score: 9.3
CVSS Temporal Score: See _https://exchange.xforce.ibmcloud.com/vulnerabilities/101255 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:C/I:C/A:C) **
AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:
**
Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical._
Fix:_**
Apply an Interim Fix, Fix Pack or PTF containing this APAR PI36211 for Full Profile and PI33202 for Liberty Profile, as noted below: **
For IBM WebSphere Application Server
For V8.5.0.0 through 8.5.5.5 Full Profile: **
-- OR
**
For V8.5.0.0 through 8.5.5.4 Liberty Profile:**
-- OR
**
For V8.0.0.0 through 8.0.0.10:**
-- OR
**
For V7.0.0.0 through 7.0.0.37:**
-- OR
_
Workaround(s):None known
Mitigation(s):_ None known
CVEID: CVE-2015-0250**
DESCRIPTION:** Apache Batik could allow a remote attacker to obtain sensitive information. By persuading a victim to open a specially-crafted SVG file, an attacker could exploit this vulnerability to reveal files and obtain sensitive information.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101614 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
**
Remediation/Fixes: The recommended solution is to apply the Interim Fix, Fix Pack or PTF for each named product as soon as practical._
Fix:_**
Apply an Interim Fix, Fix Pack or PTF containing this APAR PI39768 or PI49437, as noted below:
**For IBM WebSphere Application Server Full profile and IBM WebSphere Application Server Hypervisor Edition
For V8.5.0.0 through 8.5.5.5:**
-- OR
**
For V8.0.0.0 through 8.0.0.10:**
-- OR
**
For V7.0.0.0 through 7.0.0.37:**
-- OR
**_
_**For V6.1.0.0 through 6.1.0.47:
Workaround(s): None known**_
Mitigation(s):_** None known
CVEID: CVE-2015-1927**
DESCRIPTION:** IBM WebSphere Application Server could allow a remote attacker to gain elevated privileges on the system, caused by an application not having the correct serveServletsbyClassname setting. By a developer not setting the correct property, an attacker could exploit this vulnerability to gain unauthorized access.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102872 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
**
Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical._
Fix:_**
Apply an Interim Fix, Fix Pack or PTF containing this APAR PI31622, as noted below:
**Please Note:**This APAR has changed the default value of the WebContainer custom property com.ibm.ws.webcontainer.disallowServeServletsByClassname from false to true so that no security threat could occur. Prior to this change, it was up to the developer to remember to change the custom property to true before deploying into production.
**Property Name:**com.ibm.ws.webcontainer.disallowServeServletsByClassname
**Description:**If set to true, disallows the use of serveServletsByClassnameEnabled at the application server level, overriding any setting of serveServletsByClassnameEnabled at the application level. This property affects all applications. **
Values: **true(default)/false
If you need to change the value please refer to the the following technote for instructions on enabling WebContainer custom properties:
Full Profile: <http://www-01.ibm.com/support/docview.wss?uid=swg21284395>
Liberty Profile: <http://www-01.ibm.com/support/docview.wss?uid=swg21597753>
**
For IBM WebSphere Application Server Full profile, IBM WebSphere Application Server Liberty Profile and IBM WebSphere Application Server Hypervisor Edition
For V8.5.0.0 through 8.5.5.5:**
-- OR
**
For V8.0.0.0 through 8.0.0.10:**
-- OR
**
For V7.0.0.0 through 7.0.0.37:**
-- OR
_
Workaround(s):_ Set the custom property com.ibm.ws.webcontainer.disallowServeServletsByClassName to true**_
Mitigation(s):_** None known
CVEID: CVE-2015-1936**
DESCRIPTION:** IBM WebSphere Application Server Administrative console could allow a remote authenticated attacker to hijack a user’s session when Security is not enabled. An attacker could exploit this vulnerability using the JSESSIONID parameter to gain access to another user’s session.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/103108 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
**
Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical._
Fix:_**
Apply an Interim Fix, Fix Pack or PTF containing this APAR PI37230, as noted below:
**
For IBM WebSphere Application Server and IBM WebSphere Application Server Hypervisor Edition:
For V8.5.0.0 through 8.5.5.5:**
-- OR
**
For V8.0.0.0 through 8.0.0.11:**
-- OR
** Workaround(s): None known_
Mitigation(s):_** None known
CVEID: CVE-2015-1946**
DESCRIPTION:** IBM WebSphere Application Server 8.5 and IBM WebSphere Virtual Enterprise 7.0 could allow a local attacker to gain elevated privileges on the system cause by the user roles not being handled properly.
CVSS Base Score: 4.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/103201 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:M/Au:S/C:P/I:P/A:P)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
**
Remediation/Fixes: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical._
Fix:_**
Apply an Interim Fix, Fix Pack or PTF containing this APAR PI35180, as noted below:
For IBM WebSphere Application Server **
For V8.5.0.0 through 8.5.5.5:**
-- OR
**
For IBM WebSphere Virtual Enterprise using WebSphere Application Server V7.0 and V8.0:**
_
Workaround(s):None known
Mitigation(s):_ None known
Other APARs shipped with 8.5.5.6 are included in the security bulletins below:
PI33012 Security Bulletin for Dojo Toolkit Vulnerability
PI36563 Security Bulletin for RSA Export Keys for WebSphere Application Server
PI36563 Security Bulletin for RC4 Stream Cipher for WebSphere Application Server
PI38302 Security Bulletin for Management Port for WebSphere Application Server
PI36417 Security Bulletin for RSA Export Keys for IBM HTTP Server
PI34229 Security Bulletin for RC4 Stream Cipher for IBM HTTP Server
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C