Lucene search

K
ibmIBMD2DD1BE4D29D58D89A43D18F1B7DE1F76F26A879E8CC0420962AD235BA315B08
HistoryApr 03, 2024 - 7:37 p.m.

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to a denial of service (CVE-2024-22353)

2024-04-0319:37:54
www.ibm.com
8
ibm
websphere
application server
liberty
vulnerability
denial of service
hybrid edition
openidconnectclient-1.0
sociallogin-1.0
fix pack
apar ph59146

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

13.1%

Summary

IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to a denial of service with the openidConnectClient-1.0 or socialLogin-1.0 feature enabled.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s) and Version(s) Affecting Product(s) and Version(s)

IBM WebSphere Hybrid Edition

  • 5.1
    |

IBM WebSphere Application Server Liberty

  • 17.0.0.3 - 24.0.0.3

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the APAR PH59146 as described in Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to a denial of service (CVE-2024-22353)

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmwebsphereMatch5.1
CPENameOperatorVersion
ibm websphere hybrid editioneq5.1

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

13.1%

Related for D2DD1BE4D29D58D89A43D18F1B7DE1F76F26A879E8CC0420962AD235BA315B08