IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.5.5.6 allows remote attackers to execute arbitrary code by sending crafted instructions in a management-port session.

The remote host appears to be running IBM WebSphere Application Server 7.0 prior to 7.0.0.39. Such versions are potentially affected by multiple issues :

 - A flaw exists that is triggered as deployment descriptor security constraints are combined with 'ServletSecurity' annotations on a servlet. This may allow a remote attacker to gain elevated privileges. (CVE-2014-8890)
 - A security feature bypass vulnerability, known as FREAK (Factoring attack on RSA-EXPORT Keys), exists in the IBM Global Security Kit (GSKit) due to the support of weak EXPORT_RSA cipher suites with keys less than or equal to 512 bits.  A man-in-the-middle (MitM) attacker may be able to downgrade the SSL/TLS connection to use EXPORT_RSA cipher suites which can be factored in a short amount of time, allowing the attacker to intercept and decrypt the traffic. (CVE-2015-0138)
 - An information disclosure vulnerability exists due to a flaw in the Bleichenbacher countermeasure implementation in Apache WSS4J.  A remote attacker can exploit this, via a crafted message, to determine where an encryption failure took place, allowing the attacker to gain access to the plaintext symmetric key. (CVE-2015-0226)
 - An XML External Entity (XXE) vulnerability exists due to an incorrectly configured XML parser that accepts XML external entities from an untrusted source.  A remote attacker can exploit this, via specially crafted XML data, to gain access to arbitrary files. (CVE-2015-0250)
 - A privilege escalation vulnerability exists due to a flaw that occurs in 'full' profile and 'liberty' profile when using an OAuth grant password.  A remote attacker can exploit this to gain elevated privileges. (CVE-2015-1885)
 - A privilege escalation vulnerability exists due to incorrect settings in the 'serveServletsbyClassname' functionality.  A remote attacker can exploit this to gain elevated privileges. (CVE-2015-1927)
 - An information disclosure vulnerability exists that allows an unauthenticated, remote attacker to identify the proxy server software by reading the HTTP 'Via' header. (CVE-2015-1932)
 - An unspecified flaw exists in the administrative console that allows a remote attacker, via the 'JSESSIONID' parameter, to hijack a user's session. (CVE-2015-1936)
 - A privilege escalation vulnerability exists due to an unspecified flaw that occurs when handling user roles.  A local attacker can exploit this to gain elevated privileges. (CVE-2015-1946)
 - A flaw exists that is triggered as CRLF (Carriage Return and Line Feed) character sequences are not properly sanitized before being included in HTTP responses.  This allows a remote attacker to inject additional headers into responses to conduct HTTP response splitting attacks. (CVE-2015-2017)
 - A security feature bypass vulnerability exists, known as Bar Mitzvah, due to improper combination of state data with key data by the RC4 cipher algorithm during the initialization phase.  A MitM attacker can exploit this, via a brute-force attack using LSB values, to decrypt the traffic. (CVE-2015-2808)
 - An unspecified flaw exists that allows an unauthenticated, remote attacker to spoof servlets or disclose sensitive information. (CVE-2015-4938)
 - An unspecified exists flaw in the 'Management' port. This may allow a remote attacker to execute arbitrary code. No further details have been provided by the vendor. (CVE-2015-1920)

The IBM WebSphere Application Server running on the remote host is version 6.1.0.47 / 7.0.0.37 / 8.0.0.10 / 8.5.5.5 or prior. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     SNMP component due to improper handling of configuration     data. An authenticated, remote attacker can exploit this     disclose sensitive information. (CVE-2015-0174)

  - An unspecified flaw exists in the liberty profile due to     improper handling of authData elements. An     authenticated, remote attacker can exploit this to gain     elevated privileges. (CVE-2015-0175)

  - An unspecified flaw exists in the liberty profile that     is triggered when the run-as user for EJB is not honored     under multi-threaded race conditions. An authenticated,     remote attacker can exploit this to gain elevated     privileges. (CVE-2015-1882)

  - A flaw exists that allows a remote attacker to execute     arbitrary code by connecting to a management port using     a specific sequence of instructions. (CVE-2015-1920)

ID	Name	Product	Family	Type	Severity
9700	IBM WebSphere Application Server 7.0 < 7.0.0.39 Multiple Vulnerabilities (FREAK)	Nessus Network Monitor	Web Servers		high
83290	IBM WebSphere Application Server Multiple Vulnerabilities	Nessus	Web Servers	Remote	critical

Detections

Analytics

CVE-2015-1920

critical

Tenable Plugins

high

critical