IBM WebSphere Application Server 7.0 < Fix Pack 13 Multiple Vulnerabilities
High Nessus Plugin ID 50561
SynopsisThe remote application server is affected by multiple vulnerabilities.
DescriptionIBM WebSphere Application Server 7.0 before Fix Pack 13 appears to be running on the remote host. As such, it is reportedly affected by the following vulnerabilities :
- A cross-site scripting vulnerability exists in the administrative console due to improper filtering on input values. (PM14251)
- A cross-site scripting vulnerability exists in the Integrated Solution Console due to improper filtering on input values. (PM11777)
- An unspecified cross-site request forgery vulnerability exists in the administrative console for WebSphere Application Server. (PM18909)
- An unspecified cross-site scripting vulnerability exists in the administrative console for WebSphere Application Server for z/OS. (PM17046)
- An error exists in JAX-WS WS-Security, which mishandles timestamps in the WS-SecurityPolicy specification.
- An error exists in the JAX-WS API, which allows an attacker to cause a denial of service by sending a specially crafted JAX-WS request. The server will begin sending corrupt data to its clients. (PM13777)
- Apache Axis2/Java, used by WebSphere, is vulnerable to denial of service and information disclosure attacks due to an error in its XML DTD handling processes. (PM14844)
- An unspecified error exists in the administration console that can cause high CPU usage and denial of service when specially crafted URLs are requested.
SolutionIf using WebSphere Application Server, apply Fix Pack 13 (188.8.131.52) or later.
Otherwise, if using embedded WebSphere Application Server packaged with Tivoli Directory Server, apply the latest recommended eWAS fix pack.