Detections
Analytics
IBM WebSphere Application Server 7.0 < 7.0.0.43 / 8.0 < 8.0.0.13 / 8.5 < 8.5.5.11 / 9.0 < 9.0.0.2 Multiple Vulnerabilities
high Nessus Plugin ID 94512
Language:
Synopsis
The remote web application server is affected by multiple vulnerabilities.Description
The IBM WebSphere Application Server running on the remote host is version 7.0 prior to 7.0.0.43, 8.0 prior to 8.0.0.13, 8.5 prior to 8.5.5.11, or 9.0 prior to 9.0.0.2. It is, therefore, affected by multiple vulnerabilities :- A remote code execution vulnerability exists due to improper sanitization user-supplied input when deserializing Java objects. An authenticated, remote attacker can exploit this, via a crafted serialized object, to execute arbitrary Java code. (CVE-2016-5983)
- An information disclosure vulnerability exists due to improper handling of responses. An unauthenticated, remote attacker can exploit this to disclose sensitive server identification information. (CVE-2016-5986)
Solution
Apply IBM WebSphere Application Server version 7.0 Fix Pack 43 (7.0.0.43) / 8.0 Fix Pack 13 (8.0.0.13) / 8.5 Fix Pack 11 (8.5.5.11) / 9.0 Fix Pack 2 (9.0.0.2) or later. Alternatively, apply Interim Fixes PI67093 and PI70737.See Also
Plugin Details
Severity: High
ID: 94512
File Name: websphere_9_0_0_2.nasl
Version: 1.9
Type: remote
Family: Web Servers
Published: 11/3/2016
Updated: 1/20/2026
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.1
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS Score Source: CVE-2016-5983
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS Score Source: CVE-2016-5986
Vulnerability Information
CPE: cpe:/a:ibm:websphere_application_server
Required KB Items: Settings/ParanoidReport, www/WebSphere
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/15/2016
Vulnerability Publication Date: 9/15/2016
Reference Information
CVE: CVE-2016-5983, CVE-2016-5986