Lucene search

IBMC71A5DBCF370F048EB817F4959165CFDC0441EDB671093F1047A96EEA8FB7126

HistorySep 26, 2022 - 3:31 a.m.

Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.5.1

2022-09-2603:31:32

www.ibm.com

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.958 High

EPSS

Percentile

99.4%

JSON

Abstract

Cross reference list for security vulnerabilities fixed in IBM WebSphere Application Server Fix Pack 8.5.5.1

Content

The following vulnerabilities have been fixed in IBM WebSphere Application Server Fix Pack 8.5.5.1

VULNERABILITY DETAILS:

CVE ID:CVE-2013-0460** (PM72275)_
_
DESCRIPTION: **WebSphere Application Server could be vulnerable to a cross-site request forgery, caused by improper validation of portlets in the administrative console. By persuading a user to visit a malicious Web site, a remote attacker could exploit this vulnerability to obtain sensitive information.

CVSS: _

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/81014 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:P/A:N)_**

AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:

Version 8.5
Version 8.0
Version 7
Version 6.1

**REMEDIATION:**The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM72275, as noted below: **

For IBM WebSphere Application Server
** For V8.5 through 8.5.5.0:

Apply Fix Pack 1 (8.5.5.1), or later.

For V8.0 through 8.0.0.7:

Apply Fix Pack 8 (8.0.0.8), or later.

For V7.0 through 7.0.0.25:

Apply Fix Pack 27 (7.0.0.27), or later.

For V6.1.0 through 6.1.0.45:

Apply Fix Pack 47 (6.1.0.47), or later.

Workaround(s): None Mitigation(s): none

CVE ID:CVE-2013-4004** (PM81571)****

DESCRIPTION: **IBM WebSphere Application Server is vulnerable to cross-site scripting, caused by improper validation of input in the Administrative Console. A remote attacker could exploit this vulnerability using a specially-crafted URL to inject script into the victim’s Web browser within the security context of the hosting Web site. CVSS: _

CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85268 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:S/C:N/I:P/A:N)_**

AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:

Version 8.5
Version 8

**REMEDIATION:**The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM81571, as noted below: **

For IBM WebSphere Application Server
** For V8.5 through 8.5.5.0:

Apply Fix Pack 8.5.5.1 (8.5.5.1), or later.

For V8.0 through 8.0.0.6:

Apply Fix Pack 7 (8.0.0.7), or later.

Workaround(s): None Mitigation(s): none

CVE ID:CVE-2013-1862** (PM87808)

DESCRIPTION: IBM HTTP Server optional mod_rewrite module does not properly filter terminal escape sequences from logs, which could make it easier for a remote attacker to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.

CVSS:** _
CVSS Base Score: 5.1
CVSS Temporal Score: See _https://exchange.xforce.ibmcloud.com/vulnerabilities/84111 _for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:H/Au:N/C:P/I:P/A:P)
_**

AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:

Version 8.5
Version 8
Version 7
Version 6.1

**REMEDIATION:**The recommended solution is to apply the Fix Pack, PTF or APAR Interim Fix for each named product as soon as practical
Fix: Apply a Fix Pack, PTF or APAR Interim Fix containing this APAR PM87808, as noted below:

For affected versions of IBM HTTP Server for WebSphere Application Server: For V8.5.0.0 through 8.5.5.0 Full Profile:

Apply Fix Pack 8.5.5.1 or later.

**
For V8.0.0.0 through 8.0.0.6:**

Apply Fix Pack 8.0.0.7 or later.

For V7.0.0.0 through 7.0.0.29:

Apply Fix Pack 7.0.0.31 or later.

**
For V6.1.0.0 through 6.1.0.45:**

Apply Fix Pack 6.1.0.47 or later.

**** OR

APAR Interim Fix:

Find your applicable Version for APAR Interim Fix PM87808
Ensure you are at the minimally required Fix Pack Level before installing the APAR Interim Fix, then
Apply the APAR Interim Fix

Workaround(s): None Mitigation(s): None

CVE ID:CVE-2013-4005** (PM88208)****

DESCRIPTION:******IBM WebSphere Application Server could allow a cross-site scripting attack, caused by improper validation of input in the Administrative console. A network attacker could exploit this vulnerability using specially-crafted field values to inject script into a victim’s Web browser within the security context of the hosting Web site.
CVSS: _

CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85270 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:S/C:N/I:P/A:N)_**

AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:

Version 8.5
Version 8
Version 7
Version 6.1

**REMEDIATION:**The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM88208, as noted below: **

For IBM WebSphere Application Server
** For V8.5 through 8.5.5.0:

Apply Fix Pack 8.5.5.1 (8.5.5.1), or later.

For V8.0 through 8.0.0.6:

Apply Fix Pack 7 (8.0.0.7), or later.

For V7.0 through 7.0.0.29:

Apply Fix Pack 31 (7.0.0.31), or later.

For V6.1.0 through 6.1.0.45:* Apply Fix Pack 47 (6.1.0.47), or later.**
** **Workaround(s):**None Mitigation(s): none

CVE ID:CVE-2013-3029** (PM88746)

DESCRIPTION: **IBM WebSphere Application Server is vulnerable to a cross-site request forgery, caused by improper validation of input in the administrative console. By persuading a user to visit a malicious Web site, a remote attacker could exploit this vulnerability to obtain sensitive information, perform cross-site scripting attacks, and other malicious activities. CVSS: _

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/84591 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:P/A:N)_**

AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:

Version 8.5
Version 8
Version 7
Version 6.1

**REMEDIATION:**The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM88746, as noted below: **

For IBM WebSphere Application Server

For V8.5 through 8.5.5.0:**

Apply Fix Pack 8.5.5.1 (8.5.5.1), or later.

For V8.0 through 8.0.0.7:

Apply Fix Pack 7 (8.0.0.7), or later.

For V7.0 through 7.0.0.31:* Apply Fix Pack 31 (7.0.0.31), or later.**
** ** For V6.1 through 6.1.0.45:**

Apply Fix Pack 47 (6.1.0.47), or later.

Workaround(s): None Mitigation(s): none

**CVE ID: Multiple CVEs in the IBM Eclipse Help System (PM89893)

CVE ID:**CVE-2013-0464 **DESCRIPTION: ** A vulnerability in the IBM Eclipse Help System used by IBM WebSphere Application Server could allow a remote attacker to exploit this vulnerability using a specially-crafted URL to execute a script in a victim’s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.

CVSS forCVE-2013-0464***_
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/81060 for the current score
CVSS Environmental Score: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:P/A:N)_

CVE ID:****CVE-2013-0467 **DESCRIPTION: **A vulnerability in the IBM Eclipse Help system, used by IBM WebSphere Application Server could allow a remote attacker to obtain sensitive information. An attacker could send a specially-crafted URL to view source code on the help system server.

CVSS forCVE-2013-0467: _
CVSS Base Score: 4.0
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/81102 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:S/C:P/I:N/A:N)_

CVE IDCVE-2013-0599 **DESCRIPTION: **A vulnerability in the IBM Eclipse Help system, used by the IBM WebSphere Application Server could allow a remote attacker to obtain sensitive information.
A specially crafted URL could cause an error message to be returned in the browser that may contain sensitive information.

CVSS forCVE-2013-0599****** _
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/83613 for the current score
CVSS Environmental Score: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:P/I:N/A:N)_* **
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:

Version 8.5
Version 8.0 (only CVE-2013-0464)

**REMEDIATION:**The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM89893, as noted below: **

For IBM WebSphere Application Server

For V8.5 through 8.5.5.0:**

Apply Fix Pack 8.5.5.1 (8.5.5.1), or later.

For V8.0 through 8.0.0.1 for CVE-2013-0464

Apply Fix Pack 2 (8.0.0.2), or later.

Workaround(s): None Mitigation(s): none

CVE ID:CVE-2013-1896** (PM89996)

DESCRIPTION: IBM HTTP Server may be vulnerable to a denial of service, caused by a malicious request when using the optional mod_dav module.

CVSS:** _

CVSS Base Score: 4.3
CVSS Temporal Score: See _https://exchange.xforce.ibmcloud.com/vulnerabilities/85574 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:N/A:P)**

AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:

Version 8.5
Version 8
Version 7
Version 6.1

For affected versions of IBM HTTP Server for WebSphere Application Server: For V8.5.0.0 through 8.5.5.0 Full Profile:

Apply Fix Pack 8.5.5.1 or later.

**
For V8.0.0.0 through 8.0.0.6:**

Apply Fix Pack 8.0.0.7 or later.

For V7.0.0.0 through 7.0.0.29:

Apply Fix Pack 7.0.0.31 or later.

**
For V6.1.0.0 through 6.1.0.45:**

Apply Fix Pack 6.1.0.47 or later.

** OR**

APAR Interim Fix:

Find your applicable Version for APAR Interim Fix PM89996
Ensure you are at the minimally required Fix Pack Level before installing the APAR Interim Fix, then
Apply the APAR Interim Fix

Workaround(s): None Mitigation(s): Do not use the optional mod_dav module

CVE ID:CVE-2012-2098** (PM90088)

DESCRIPTION: **IBM WebSphere Application Server may be vulnerable to a denial of service, caused by the use of Apache Ant to compress files. By passing specially-crafted input, a local attacker could exploit this vulnerability to consume available resources.

CVSS: _

CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/75857 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:L/Au:N/C:N/I:N/A:P)_**

AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:

Version 8.5
Version 8
Version 7
Version 6.1

**REMEDIATION:**The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM90088, as noted below: **

For IBM WebSphere Application Server
** For V8.5 through 8.5.5.0:

Apply Fix Pack 8.5.5.1 (8.5.5.1), or later.

For V8.0 through 8.0.0.6:

Apply Fix Pack 7 (8.0.0.7), or later.

For V7.0 through 7.0.0.29:

Apply Fix Pack 31 (7.0.0.31), or later.

For V6.1.0 through 6.1.0.45:* Apply Fix Pack 47 (6.1.0.47), or later.**
** **Workaround(s):**None Mitigation(s): none

CVE ID:CVE-2013-4006** (PM90472)

DESCRIPTION: **IBM WebSphere Application Server Liberty Profile could allow a local attacker to obtain sensitive information due to insecure permissions of files created by the Liberty Server. Liberty Profile server files and directories created prior to applying this fix pack should be secured by using the 'chmod" command to turn off access permissions for the ‘other’ category.

CVSS: _

CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/85273 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:S/C:P/I:N/A:N)_**

AFFECTED VERSIONS**: The following IBM WebSphere Application Server Liberty Profile Versions are affected:

Version 8.5

**REMEDIATION:**The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM90472, as noted below: **

For IBM WebSphere Application Server
** For V8.5 through 8.5.5.0:* Apply Fix Pack 8.5.5.1 (8.5.5.1), or later.** **

**Workaround(s):**Liberty Profile server files and directories created prior to applying this fix pack should be secured by using the 'chmod" command to turn off access permissions for the ‘other’ category. Mitigation(s): none

CVE ID:CVE-2013-4053** (PM90949 and PM91521)_
_
DESCRIPTION: **WebSphere Application Server using WS-Security and configured for XML Digital Signature using trust store, could allow a network attacker to gain elevated privileges on the system, caused by improper checking of the certificate.

CVSS: _

CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/86505 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:P/I:P/A:P)_**

AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:

Version 8.5
Version 8
Version 7
Version 6.1

**REMEDIATION:**The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF for WebSphere Application Server as noted below: **

For IBM WebSphere Application Server (PM90949)
** For V8.5 through 8.5.5.0:

Apply Fix Pack 1 (8.5.5.1), or later.

For V8.0 through 8.0.0.7:

Apply Fix Pack 8 (8.0.0.8), or later.

For V7.0 through 7.0.0.29:

Apply Fix Pack 31 (7.0.0.31), or later.

For V6.1.0 through 6.1.0.45:

Apply Fix Pack 47 (6.1.0.47), or later.

** OR**

APAR Interim Fix:

Find your applicable Version for APAR Interim Fix PM90949
Ensure you are at the minimally required Fix Pack Level before installing the APAR Interim Fix, then
Apply the APAR Interim Fix

**For IBM WebSphere Application Server Feature Pack for Web Services (PM91521) **
For V6.1.0 through 6.1.0.45:

Apply Fix Pack 47 (6.1.0.47), or later.

** OR**

APAR Interim Fix:

Find your applicable Version for APAR Interim Fix PM91521
Ensure you are at the minimally required Fix Pack Level before installing the APAR Interim Fix, then
Apply the APAR Interim Fix

Workaround(s): None Mitigation(s): none

CVE ID:CVE-2013-4052** (PM91892)_
_
DESCRIPTION: **WebSphere Application Server could allow a cross-site scripting attack, caused by improper validation of input in the UDDI Administrative console. A network attacker could exploit this vulnerability using a specially-crafted URL to inject script into a victim’s Web browser within the security context of the hosting Web site.

CVSS: _

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/86504 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:P/A:N)_**

AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:

Version 8.5
Version 8
Version 7
Version 6.1

**REMEDIATION:**The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM91892, as noted below: **

For IBM WebSphere Application Server
** For V8.5 through 8.5.5.0:

Apply Fix Pack 1 (8.5.5.1), or later.

** For V8.0 through 8.0.0.7:**

Apply Fix Pack 8 (8.0.0.8), or later.

For V7.0 through 7.0.0.29:

Apply Fix Pack 31 (7.0.0.31), or later.

For V6.1.0 through 6.1.0.45:

Apply Fix Pack 47 (6.1.0.47), or later.

Workaround(s): None Mitigation(s): none

CVE ID:CVE-2013-5414** (PM92313)_
_
DESCRIPTION: **WebSphere Application Server could allow existing users to gain elevated privileges on the system caused by incorrect Administration Security roles being assigned after migration from version 6.1 or later.

NOTE: If a migration from WebSphere Application Server Version 6.1 or later has already been performed, all users designated with “adminsecmanager” (Administrative Security Manager) role need to be evaluated to determine if they should have both “admin” role and “adminsecmanager” role. Some users may not need both designations and the privileges should be removed accordingly.

CVSS: _

CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87476 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:S/C:N/I:P/A:N)_**

AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:

Version 8.5
Version 8
Version 7

**REMEDIATION:**The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM92313, as noted below: **

For IBM WebSphere Application Server
** For V8.5 through 8.5.5.0:

Apply Fix Pack 1 (8.5.5.1), or later.

For V8.0 through 8.0.0.7:

Apply Fix Pack 8 (8.0.0.8), or later.

For V7.0 through 7.0.0.29:

Apply Fix Pack 31 (7.0.0.31), or later.

**Workaround(s):**If a migration from WebSphere Application Server Version 6.1 or later has already been performed, all users designated with “adminsecmanager” role need to be evaluated to determine if they should have both “admin” role and “adminsecmanager” (Administrative Security Manager) role. Some users may not need both designations and the privileges should be removed accordingly._ _ Mitigation(s): none

CVE ID:CVE-2013-5417** (PM93323 and PM93944)_
_
DESCRIPTION: **WebSphere Application Server could be vulnerable to cross-site scripting, caused by improper validation of application HTTP response data.

CVSS: _

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87479 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:P/A:N)_**

AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:

Version 8.5
Version 8
Version 7

**REMEDIATION:**The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing APAR PM93323 for IBM WebSphere Application Server Full Profile or APAR PM93944 for IBM WebSphere Application Server Liberty Profile, as noted below: **

For IBM WebSphere Application Server Full Profile
** For V8.5 through 8.5.5.0:

Apply Fix Pack 1 (8.5.5.1), or later.

For V8.0 through 8.0.0.7:

Apply Fix Pack 8 (8.0.0.8), or later.

For V7.0 through 7.0.0.29:

Apply Fix Pack 31 (7.0.0.31), or later.

**For IBM WebSphere Application Server Liberty Profile **
For V8.5 through 8.5.5.0:

Apply Fix Pack 1 (8.5.5.1), or later.

Workaround(s): None Mitigation(s): none

CVE ID:CVE-2013-5425** (PM93828)_
_
DESCRIPTION: ** IBM WebSphere Application Server may be vulnerable to cross-site scripting in the Administration Console caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in the victim’s Web browser within the security context of the hosting Web site, once the URL is clicked.

CVSS: _

CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87487 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:S/C:N/I:P/A:N)_**

AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:

IBM WebSphere Application Server Version 8.5

**REMEDIATION:The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix: Apply a Fix Pack, PTF or APAR Interim Fix containing this APAR PM93828, as noted

For IBM WebSphere Application Server
** For V8.5 through 8.5.5.0:

Apply Fix Pack 1 (8.5.5.1), or later.

APAR Interim Fix:

Find your applicable Version for APAR Interim Fix PM93828
Ensure you are at the minimally required Fix Pack Level before installing the APAR Interim Fix, then
Apply the APAR Interim Fix

Workaround(s): None Mitigation(s): none

CVE ID:CVE-2013-5418** (PM96477)_
_
DESCRIPTION: **WebSphere Application Server could allow a cross-site scripting attack, caused by improper validation of input in the Administrative console. A remote attacker could exploit this vulnerability using a specially-crafted URL to inject script into a victim’s Web browser within the security context of the hosting Web site.

CVSS: _

CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/87480 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:S/C:N/I:P/A:N)_**

AFFECTED VERSIONS**: The following IBM WebSphere Application Server Versions are affected:

Version 8.5
Version 8
Version 7

**REMEDIATION:**The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM96477, as noted below: **

For IBM WebSphere Application Server
** For V8.5 through 8.5.5.0:

Apply Fix Pack 1 (8.5.5.1), or later.

For V8.0 through 8.0.0.7:

Apply Fix Pack 8 (8.0.0.8), or later.

For V7.0 through 7.0.0.29:

Apply Fix Pack 31 (7.0.0.31), or later.

Workaround(s): None Mitigation(s): none

**IBM SDK:**Please refer to this security bulletin for SDK fixes that were shipped with WebSphere Application Server Version 8.5.5.1
http://www-01.ibm.com/support/docview.wss?&uid=swg21644157

**
Important note: **IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.

REFERENCES:
Complete CVSS Guide
On-line Calculator V2
WebSphere Application Server Recommended Fixes Page

CHANGE HISTORY:

11 November 2013: Original copy published

_
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash. _
_
Note: _According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an “industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response.” IBM PROVIDES THE CVSS SCORES “AS IS” WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

[{“Product”:{“code”:“SSEQTP”,“label”:“WebSphere Application Server”},“Business Unit”:{“code”:“BU059”,“label”:“IBM Software w/o TPS”},“Component”:“General”,“Platform”:[{“code”:“PF002”,“label”:“AIX”},{“code”:“PF010”,“label”:“HP-UX”},{“code”:“PF012”,“label”:“IBM i”},{“code”:“PF016”,“label”:“Linux”},{“code”:“PF027”,“label”:“Solaris”},{“code”:“PF033”,“label”:“Windows”},{“code”:“PF035”,“label”:“z/OS”}],“Version”:“8.5;8.0;7.0;6.1”,“Edition”:“Base;Developer;Enterprise;Liberty;Network Deployment”,“Line of Business”:{“code”:“LOB45”,“label”:“Automation”}}]

CPENameOperatorVersion
websphere application servereq8.5
websphere application servereq8.0
websphere application servereq7.0
websphere application servereq6.1