Detections
Analytics
IBM WebSphere Application Server 7.0 < Fix Pack 3
high Nessus Plugin ID 36133
Language:
Synopsis
The remote application server is affected by multiple vulnerabilities.Description
IBM WebSphere Application Server 7.0 before Fix Pack 3 appears to be running on the remote host. As such, it is reportedly affected by multiple vulnerabilities :- Under certain conditions it may be possible to access administrative console user sessions. (PK74966)
- The administrative console is affected by a cross-site scripting vulnerability. (PK77505)
- If APAR PK41002 has been applied, a vulnerability in the JAX-RPC WS-Security component could incorrectly validate 'UsernameToken'. (PK75992)
- Sample applications shipped with IBM WebSphere Application Server are affected by cross-site scripting vulnerabilities. (PK76720)
- Certain files associated with interim fixes for Unix- based versions of IBM WebSphere Application Server are built with insecure file permissions. (PK77590)
- The Web Services Security component is affected by an unspecified security issue in digital-signature specification. (PK80596)
- It may be possible for an attacker to read arbitrary application-specific war files. (PK81387)
- A security bypass caused by inbound requests that lack a SOAPAction or WS-Addressing Action. (PK72138)
Solution
Apply Fix Pack 3 (7.0.0.3) or later.See Also
http://www-01.ibm.com/support/docview.wss?uid=swg24022693
http://www-01.ibm.com/support/docview.wss?uid=swg24022456
http://www-01.ibm.com/support/docview.wss?uid=swg21367223
http://www-01.ibm.com/support/docview.wss?uid=swg27014463#7003
Plugin Details
Severity: High
ID: 36133
File Name: websphere_7_0_0_3.nasl
Version: 1.19
Type: remote
Family: Web Servers
Published: 4/10/2009
Updated: 8/6/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:ibm:websphere_application_server
Required KB Items: www/WebSphere
Exploit Ease: No known exploits are available
Patch Publication Date: 3/27/2009
Reference Information
CVE: CVE-2009-0508, CVE-2009-0892, CVE-2009-0903, CVE-2009-1172, CVE-2009-1173, CVE-2009-1174