Lucene search

IBMCF8D4CFF36C27F27433C08DDFCC18A9234F4D48628F426483A24ADE3287B1C30

HistoryJun 26, 2024 - 3:04 p.m.

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is vulnerable to cross-site scripting (CVE-2024-35153)

2024-06-2615:04:24

www.ibm.com

ibm

websphere

cross-site scripting

cloud pak

vulnerability

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

5.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Summary

IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is vulnerable to cross-site scripting in the administrative console.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s) and Version(s)	Affecting Product(s) and Version(s)

IBM Cloud Pak for Applications

5.1
|

IBM WebSphere Application Server

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the APAR PH61546. as described in Security Bulletin: IBM WebSphere Application Server is vulnerable to cross-site scripting (CVE-2024-35153).

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmcloud_pak_for_applicationsMatch5.1

CPENameOperatorVersion
ibm cloud pak for applicationseq5.1

CPE	Name	Operator	Version
	ibm cloud pak for applications	eq	5.1