Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Tivoli Federated Identity Manager

Summary

IBM WebSphere Application Server (WAS) is shipped with IBM Tivoli Federated Identity Manager. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Remediation/Fixes

WAS 9.0, 8.5, 8.0 and 7.0

|

Security Bulletin: WebSphere Application Server is vulnerable to command execution vulnerability(CVE-2020-4163)

IBM Tivoli Federated Identity Manager. ALL versions

|

WAS traditional versions 9.0, 8.5, 8.0 and 7.0

|

Security Bulletin: IBM WebSphere Application Server traditional is vulnerable to a privilege escalation vulnerability (CVE-2020-4276)

IBM Tivoli Federated Identity Manager. ALL versions

|

WAS traditional versions 9.0, 8.5, 8.0 and 7.0

|

Security Bulletin: WebSphere Application Server traditional is vulnerable to a privilege escalation vulnerability(CVE-2020-4362)

IBM Tivoli Federated Identity Manager. ALL versions

|

WAS traditional versions 9.0, 8.5

|

Security Bulletin:WebSphere Application Server traditional is vulnerable to a Remote Command Execution vulnerability.(CVE-2020-4450)

IBM Tivoli Federated Identity Manager. ALL versions

|

WAS ND traditional 8.5 and 9.0

WebSphere Virtual Enterprise Edition V7.0 and V8.0

|

Security Bulletin:Remote code execution vulnerability in WebSphere Application Server ND(CVE-2020-4448)

IBM Tivoli Federated Identity Manager. ALL versions

|

WAS 9.0, 8.5, 8.0 and 7.0

WAS liberty

|

Security Bulletin:Information disclosure in WebSphere Application Server(CVE-2020-4329)

IBM Tivoli Federated Identity Manager. ALL versions

|

WAS traditional 7.0, 8.0, 8.5 and 9.0

|

Security Bulletin:WebSphere Application Server traditional is vulnerable to a Information Disclosure vulnerability(CVE-2020-4449)

IBM Tivoli Federated Identity Manager. ALL versions

|

WAS traditional version 8.5

|

Security Bulletin:WebSphere Application Server traditional is vulnerable to a server-side request forgery vulnerability(CVE-2020-4365)

Workarounds and Mitigations

None