http://www.ibm.com/support/docview.wss?uid=swg22009704

101522

1039695

https://exchange.xforce.ibmcloud.com/vulnerabilities/132342

The IBM WebSphere Application Server running on the remote host is version 8.0.0.x prior to 8.0.0.15 or 8.5.0.x prior to 8.5.5.13. It is, therefore, affected by two information disclosure vulnerabilities in the Java Server Faces (JSF) subcomponent.

  - IBM WebSphere Application Server allows a remote attacker to obtain sensitive information caused by     improper error handling by MyFaces in JSF. (CVE-2017-1583)

  - The Apache MyFaces subcomponent allows a remote attacker to obtain sensitive information. An attacker can     exploit this vulnerability using specially crafted parameters to inject EL expressions into input fields     mapped as view parameters and obtain sensitive information. (CVE-2011-4343)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

CVE-2017-1583

high

Tenable Plugins

high