IBMC697408BFF50B0037FDBA174DD0026EF434F896498D825B3EBBA4A668B2DD106Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Security Directory Server (CVE-2018-1902, CVE-2018-1926, CVE-2019-4030, CVE-2019-4046,CVE-2019-4080)
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
Summary
IBM WebSphere Application Server (WAS) is shipped with IBM Security Directory Server (ISDS). Information about security vulnerabilities affecting IBM WebSphere Application Server have been published in a security bulletin.
Vulnerability Details
Refer to the security bulletin listed in the Remediation/Fixes section.
Affected Products and Versions
| Product Version | WebSphere version |
|---|---|
| IBM Security Directory Server 6.4 - 6.4.17 | WAS v8.5.5.14 & Below |
Remediation/Fixes
Refer to the following security bulletin for vulnerability details and information about fixes addressed by IBM WebSphere Application Server which is shipped with IBM Security Directory Server.
| Principal Product and Version(s) | Affected Supporting Product and Version | Affected Supporting Product Security Bulletin |
|---|---|---|
| IBM Security Directory Server 6.4 | WebSphere Application Server v8.5.5 |
Security Bulletin: Potential Spoofing vulnerability in WebSphere Application Server (CVE-2018-1902)
Security Bulletin: Potential cross-site request forgery in WebSphere Application Server Admin Console (CVE-2018-1926)
Security Bulletin: Cross-site scripting vulnerability in WebSphere Application Server Admin Console (CVE-2019-4030)
Security Bulletin: Potential denial of service vulnerability in WebSphere Application Server (CVE-2019-4046)
Security Bulletin: Potential denial of service in WebSphere Application Server Admin Console (CVE-2019-4080)
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm security directory server | eq | 6.4 |
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P