Detections
Analytics
IBM WebSphere Portal 8.0.0.x < 8.0.0.1 CF19 PI51395 and PI53426 Multiple Vulnerabilities
high Nessus Plugin ID 93075
Language:
Synopsis
The web portal software installed on the remote Windows host is affected by multiple vulnerabilities.Description
The version of IBM WebSphere Portal installed on the remote host is 8.0.0.x prior to 8.0.0.1 CF19 with interim fixes PI51395 and PI53426.It is, therefore, affected by multiple vulnerabilities :
- An information disclosure vulnerability exists in the Portal AccessControl REST API that allows an unauthenticated, remote attacker to bypass access control lists and disclose sensitive configuration information. (CVE-2015-7447)
- An unspecified flaw exists when handling a specially crafted request that allows an unauthenticated, remote attacker to inject LDAP content and view, add, modify or delete information in the user repository.
(CVE-2015-7472)
Solution
Upgrade to IBM WebSphere Portal version 8.0.0.1 CF19 with interim fixes PI51395 and PI53426. Alternatively, upgrade to version 8.0.0.1 CF20.See Also
Plugin Details
Severity: High
ID: 93075
File Name: websphere_portal_8_0_0_1_cf19.nasl
Version: 1.4
Type: local
Family: CGI abuses
Published: 8/23/2016
Updated: 8/6/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.0
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS v3
Risk Factor: High
Base Score: 7.2
Temporal Score: 6.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:ibm:websphere_portal
Required KB Items: installed_sw/IBM WebSphere Portal
Exploit Ease: No exploit is required
Patch Publication Date: 12/15/2015
Vulnerability Publication Date: 12/15/2015
Reference Information
CVE: CVE-2015-7447, CVE-2015-7472