Security Bulletin: Open Redirect vulnerability in WebSphere Application Server Liberty (CVE-2016-3040)

Summary

There is a potential for an open redirect vulnerability when using WebSphere Application Server Liberty Profile.

Vulnerability Details

CVEID: CVE-2016-3040**
DESCRIPTION:** IBM WebSphere Application Server Liberty could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability. An attacker could exploit this vulnerability to redirect a victim to arbitrary Web sites.
CVSS Base Score: 6.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114636 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N)

Affected Products and Versions

This vulnerability affects IBM WebSphere Application Server Liberty

Remediation/Fixes

The recommended solution is to apply the interim fix, Fix Pack or PTF containing APAR PI63929 for each named product as soon as practical.
**
For WebSphere Application Server Liberty:**
· Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PI63929
--OR–
· Apply Fix Pack 16.0.0.3 or later.

Workarounds and Mitigations

none