IBMAD39C416EB5696DBABB8F348C24A823CB98337B9E36B23DC91AC6C26EC0E76D4Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server used in IBM Predictive Maintenance and Quality and Predictive Maintenance Insights
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
Summary
There are multiple security vulnerabilities that affect the IBM WebSphere Application Server in the IBM Cloud. WebSphere Application Server is vulnerable to a remote code execution vulnerability. Information disclosure vulnerability in WebSphere Application Server. There is a remote code execution vulnerability in WebSphere Application Server Network Deployment.
Vulnerability Details
Refer to the security bulletin(s) listed in the Remediation/Fixes section
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Predictive Maintenance and Quality | All |
| IBM Predictive Maintenance Insights On-Premises |
All
These vulnerabilities affect IBM WebSphere Application Server and WebSphere Application Server ND versions 9 and 8.5 in IBM Predictive Maintenance and Quality and Predictive Maintenance Insights.
Remediation/Fixes
To patch WebSphere Application Server and and WebSphere Application Server ND, please refer to Security Bulletins below:
Remote code execution vulnerability in WebSphere Application Server ND (CVE-2020-4448)
WebSphere Application Server is vulnerable to an information exposure vulnerability (CVE-2020-4449)
WebSphere Application Server is vulnerable to a remote code execution vulnerability (CVE-2020-4450)
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm iot predictive maintenance and optimization | eq | 1.0.3 | |
| predictive maintenance and quality | eq | 2.6.3 |
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C