Information disclosure in IBM WebSphere Application Server - CVE-2018-1614
Published: June 22, 2018 / Updated: June 25, 2018
Vulnerability identifier: #VU13452
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1614
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The vulnerability exists in IBM WebSphere Application Server due to unspecified flaw. A remote attacker can cause a remote SAML identity provider to return a specially crafted SAML response to view potentially sensitive information on the target system.
Affected software
IBM WebSphere Application Server
IBM Tivoli System Automation Application Manager
IBM Tivoli System Automation Application Manager
How to mitigate CVE-2018-1614
Install update from vendor's website.
IBM WebSphere Application Server - addressed in versions 8.5.5.14, 9.0.0.9