Security Bulletin: Potential Security exposures with WebSphere Application Server (CVE-2014-4770 and CVE-2014-4816)

Summary

There is a potential cross-site scripting (XSS) and a potential cross-site request forgery (CSRF) security vulnerability in WebSphere Application Server.

Vulnerability Details

CVEID: CVE-2014-4770

Description: IBM WebSphere Application Server may be vulnerable to cross-site scripting, caused by improper validation of input in the Administrative Console. A remote attacker with Administrative authority could exploit this vulnerability using a specially crafted URL to inject script into a victim’s Web browser within the security context of the hosting Web site.

CVSS:
CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95209 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVEID: CVE-2014-4816

Description: IBM WebSphere Application Server may be vulnerable to a cross-site request forgery, caused by improper validation of input in the Administrative Console. By persuading a user to visit a malicious Web site, a remote attacker could exploit this vulnerability to obtain sensitive information, perform cross-site scripting attacks, perform session injection and other malicious activities.

CVSS:
CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95402 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

Affected Products and Versions

These problems affect the following versions of the WebSphere Application Server or WebSphere Application Server Hypervisor Edition:
· Version 8.5
· Version 8.0
· Version 7.0
· Version 6.1
· Version 6.0.2

Remediation/Fixes

The recommended solution is to apply the Interim Fix, Fix Pack or PTF for each named product as soon as practical.

**Fix:**Apply an Interim Fix, Fix Pack or PTF containing APAR PI23055, as noted below:

For affected IBM WebSphere Application Server:

For V8.5.0.0 through 8.5.5.3:

• Apply Fix Pack 8.5.5.0 or later

• Then apply Interim Fix PI23055
  --OR–

• Apply Fix Pack 8.5.5.4 or later.
  ** **For V8.0.0.0 through 8.0.0.9:

• Apply Fix Pack 8.0.0.6 or later

• Then apply interim Fix PI23055
  --OR–

• Apply Fix Pack 8.0.0.10 or later.**

**
For V7.0.0.0 through 7.0.0.33:

• Apply Fix Pack 7.0.0.27 or later

• Then apply Interim Fix PI23055
  --OR–

• Apply Fix Pack 7.0.0.35 or later.
  ** **For V6.1.0.0 through 6.1.0.47:

• Apply Fix Pack 6.1.0.47 and then apply Interim Fix PI23055

Workarounds and Mitigations

none