Information disclosure in IBM WebSphere Application Server

Published: 2023-01-24
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2022-43917
Exploitation vector Network
Public exploit N/A
Vulnerable software
IBM WebSphere Application Server
Server applications / Application servers

Vendor IBM Corporation

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Inadequate Encryption Strength

EUVDB-ID: #VU71483

Risk: Medium


CVE-ID: CVE-2022-43917


Exploit availability:


The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the IBM WebSphere Application Server traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information.A remote attacker can gain access to sensitive information.

Note, this affects only the containerized version of WebSphere Application Server traditional.


Install updates from vendor's website.

Vulnerable software versions

IBM WebSphere Application Server: -

Fixed software versions

CPE2.3 External links

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?