Main Vulnerability Database SB2017122101

SB2017122101 - Information disclosure in IBM WebSphere Portal

Published: December 21, 2017

Security Bulletin ID SB2017122101

CSH Severity

Low

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Information disclosure

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 vulnerability.

1) Information disclosure (CVE-ID: CVE-2017-1698)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to unspecified condition that exist when returning an error message. A remote attacker can send a specially crafted request, trigger an error message response and access sensitive information within the error message.

Successful exploitation of the vulnerability may result in further attacks.

Remediation

Install update from vendor's website.

References

http://www-01.ibm.com/support/docview.wss?uid=swg22011519