SB2017050102 - CSRF in IBM WebSphere Application Server
Published: May 1, 2017
Security Bulletin ID
SB2017050102
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Cross-site request forgery (CVE-ID: CVE-2017-1194)
The vulnerability allows a remote attacker to perform CSRF attack.
The vulnerability exists due to improper validation of the HTTP request origin within the OAuth service provider. A remote attacker can create a specially crafted web page, trick the victim into opening it and perform certain actions on the WebSphere Application Server with privileges of the current user.
Remediation
Install update from vendor's website.