Lucene search

K
ibmIBMCC8B04F45F40D826769D0E9C0918AA28207164A9A18FB4906811ACC54E65CBF0
HistoryJun 28, 2023 - 10:02 p.m.

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server, which is shipped with, or a required product for, IBM Tivoli Network Manager IP Edition.

2023-06-2822:02:34
www.ibm.com
6

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.3%

Summary

IBM WebSphere Application Server is shipped with IBM Tivoli Network Manager IP Edition versions 3.9 and 4.1.1; IBM WebSphere Application Server is a required product for IBM Tivoli Network Manager IP Edition version 4.2. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin.

Vulnerability Details

Please consult the security bulletin Information disclosure in WebSphere Application Server (CVE-2017-1681) for vulnerability details and information about fixes.

Affected Products and Versions

IBM Tivoli Network Manager IP Edition 3.9, 4.1.1 and 4.2

Remediation/Fixes

Refer to the following security bulletins for vulnerability details and information about fixes addressed by IBM WebSphere Application Server, which is shipped with IBM Tivoli Network Manager IP Edition versions 3.9 and 4.1.1; and a product required by IBM Tivoli Network Manager IP Edition version 4.2.

Principal Product and Version(s) Affected Supporting Product and Version Affected Supporting Product Security Bulletin
IBM Tivoli Network Manager IP Edition 3.9 Fixpack 1 - Fixpack 5 Bundled the TIP version 2.1.0.x, which bundles IBM WebSphere version 7.0.0.x. Information disclosure in WebSphere Application Server (CVE-2017-1681)
See Section “For V7.0.0.0 through 7.0.0.43:
IBM Tivoli Network Manager IP Edition 4.1.1 FixPack 1 - Fixpack 2 Bundled the TIP version 2.2.0.x, which bundles IBM WebSphere version 7.0.0.x. Information disclosure in WebSphere Application Server (CVE-2017-1681)
See Section “For V7.0.0.0 through 7.0.0.43:
IBM Tivoli Network Manager IP Edition 4.2.0 - Fix Pack 1 - Fixpack 3. IBM Tivoli Network Manager IP Edition 4.2 requires the installation of IBM WebSphere Application Server Version 8.5.5.5 or later version separately. Users are recommended to apply IBM WebSphere version 8.5.5.5 Security Interim Fixes… Information disclosure in WebSphere Application Server (CVE-2017-1681)
See Section “For V8.5.0.0 through 8.5.5.12:

Workarounds and Mitigations

None

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.3%

Related for CC8B04F45F40D826769D0E9C0918AA28207164A9A18FB4906811ACC54E65CBF0