IBM WebSphere Application Server (IBM Liberty for Java for Bluemix 3.13)could allow a remote attacker to obtain sensitive information caused by improper error handling by MyFaces in JSF.

The IBM WebSphere Application Server running on the remote host is version 8.0.0.x prior to 8.0.0.15 or 8.5.0.x prior to 8.5.5.13. It is, therefore, affected by two information disclosure vulnerabilities in the Java Server Faces (JSF) subcomponent.

  - IBM WebSphere Application Server allows a remote attacker to obtain sensitive information caused by     improper error handling by MyFaces in JSF. (CVE-2017-1583)

  - The Apache MyFaces subcomponent allows a remote attacker to obtain sensitive information. An attacker can     exploit this vulnerability using specially crafted parameters to inject EL expressions into input fields     mapped as view parameters and obtain sensitive information. (CVE-2011-4343)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

CVE-2017-1583

high

Tenable Plugins

high