SB2022061411 - Multiple Vulnerabilities in IBM WebSphere Application Server
Published: June 14, 2022 Updated: August 22, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2022-21299)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The vulnerability exists due to improper input validation within the JAXP component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.
2) Improper input validation (CVE-ID: CVE-2022-21496)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the JNDI component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
Remediation
Install update from vendor's website.
References
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-sdk-affect-ibm-websphere-application-server-and-ibm-websphere-application-server-liberty-due-to-april-2022-cpu-plus-deferred-cve-2022-2129/"
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-sdk-affect-ibm-websphere-application-server-and-ibm-websphere-application-server-liberty-due-to-april-2022-cpu-plus-deferred-cve-2022-2129/</a><br><a
- https://www.ibm.com/support/pages/node/6594523"
- https://www.ibm.com/support/pages/node/6594523</a><br><br><br></p>