Detections
Analytics
IBM WebSphere Application Server 7.0 < Fix Pack 19 Multiple Vulnerabilities
medium Nessus Plugin ID 56229
Language:
Synopsis
The remote application server may be affected by multiple vulnerabilities.Description
IBM WebSphere Application Server 7.0 before Fix Pack 19 appears to be running on the remote host. As such, it is potentially affected by the following vulnerabilities :- An open redirect vulnerability exists related to the 'logoutExitPage' parameter. This can allow remote attackers to trick users into requesting unintended URLs. (PM35701)
- The administrative console can display a stack trace under unspecified circumstances and can disclose potentially sensitive information to local users.
(PM36620)
- The Installation Verification Tool servlet (IVT) does not properly sanitize user-supplied input of arbitrary HTML and script code, which could allow cross-site scripting attacks. (PM40733)
- A token verification error exists in the bundled OpenSAML library. This error can allow an attacker to bypass security controls with an XML signature wrapping attack via SOAP messages. (PM43254)
- A directory traversal attack is possible via unspecified parameters in the 'help' servlet. (PM45322)
Solution
If using WebSphere Application Server, apply Fix Pack 19 (7.0.0.19) or later.Otherwise, if using embedded WebSphere Application Server packaged with Tivoli Directory Server, apply the latest recommended eWAS fix pack.
See Also
http://www-01.ibm.com/support/docview.wss?uid=swg21404665
http://www-01.ibm.com/support/docview.wss?uid=swg27009778
http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg27014463#70019
Plugin Details
Severity: Medium
ID: 56229
File Name: websphere_7_0_0_19.nasl
Version: 1.12
Type: remote
Family: Web Servers
Published: 9/19/2011
Updated: 8/6/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P
Vulnerability Information
CPE: cpe:/a:ibm:websphere_application_server
Required KB Items: www/WebSphere
Exploit Ease: No known exploits are available
Patch Publication Date: 9/12/2011
Vulnerability Publication Date: 7/15/2011
Reference Information
CVE: CVE-2011-1355, CVE-2011-1356, CVE-2011-1359, CVE-2011-1362, CVE-2011-1411