Detections
Analytics
IBM WebSphere Application Server 9.0 < 9.0.0.2 Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 9881
Synopsis
The remote host is running an application server that is vulnerable to multiple attack vectors.Description
The remote host appears to be running IBM WebSphere Application Server 9.0 prior to 9.0.0.2. Such versions are potentially affected by multiple issues :- A flaw exists that is triggered during the handling of responses. This may allow a remote attacker gain access to sensitive server identification information.
- A flaw exists that is triggered as input is not properly sanitized when deserializing Java objects. This may allow an authenticated remote attacker to potentially execute arbitrary code.
- An unspecified flaw exists that is triggered during the handling of SOAP requests. This may allow a remote attacker to gain access to potentially sensitive information.
Solution
Upgrade WebSphere Application Server to 9.0.0.2 or later.See Also
Plugin Details
Severity: High
ID: 9881
Family: Web Servers
Published: 1/25/2017
Updated: 3/6/2019
Nessus ID: 94512
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 8.4
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:ibm:websphere_application_server
Patch Publication Date: 9/22/2016
Vulnerability Publication Date: 9/15/2016