IBM WebSphere Application Server 7.0.0.x <= 7.0.0.45 / 8.0.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.16 / 9.0.0.x < 9.0.0.11 Information Disclosure Vulnerability (CVE-2018-1996)

Low Nessus Plugin ID 124023

Synopsis

The remote web application server is affected by an information disclosure vulnerability.

Description

The IBM WebSphere Application Server running on the remote host is version 7.0.0.0 through 7.0.0.45, 8.0.0.0 through 8.0.0.15, 8.5.x prior to 8.5.5.16, or 9.0.0.x prior to 9.0.0.11. It is, therefore, affected by a potential information disclosure vulnerability. An improper TLS configuration could cause the IBM WebSphere Application Server to provider weaker than expected security. A remote attacker could exploit this to disclose sensitive information using a man in the middle attack.

Solution

Upgrade to IBM WebSphere Application Server 8.5.5.16 or 9.0.0.11 or later. Alternatively, upgrade to the minimal fix pack levels required by the interim fix and then apply Interim Fix PH05769.

See Also

https://www-01.ibm.com/support/docview.wss?uid=ibm10793421

Plugin Details

Severity: Low

ID: 124023

File Name: websphere_cve-2018-1996.nasl

Version: 1.3

Type: remote

Family: Web Servers

Published: 2019/04/12

Updated: 2019/10/30

Dependencies: 57034

Configuration: Enable paranoid mode

Risk Information

Risk Factor: Low

CVSS Score Source: CVE-2018-1996

CVSS v2.0

Base Score: 3.5

Temporal Score: 2.6

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:N/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ibm:websphere_application_server

Required KB Items: www/WebSphere, Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 2019/02/14

Vulnerability Publication Date: 2019/02/14

Reference Information

CVE: CVE-2018-1996

BID: 105954

IAVA: 2019-A-0110