CVE-2022-39161

IBM WebSphere Application Server information disclosure

Description

IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server, could allow an authenticated user to conduct spoofing attacks. A man-in-the-middle attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 235069.

Scores

Faiblesses (CWE)

• CWE-295

Références européennes

• ENISA EUVD · EUVD-2022-41706
• GCVE · GCVE-0-2022-39161

Avis du CERT-FR

• CERTFR-2023-AVI-0705 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

• cpe:2.3:a:ibm:websphere_application_server:-:*:*:*:liberty:*:*:*
• cpe:2.3:a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm:websphere_application_server:8.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*
• cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*

Produits affectés

Références

• https://www.ibm.com/support/pages/node/6987779
• https://exchange.xforce.ibmcloud.com/vulnerabilities/235069

Sources