Configuration in IBM WebSphere Application Server - CVE-2023-35890

Vulnerability identifier: #VU77813

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-35890

CWE-ID: CWE-16

Exploitation vector: Remote access

Exploit availability: No public exploit available

The issue may allow a remote attacker to bypass expected security restrictions.

The issue exists due to improper encoding in a local configuration file. A remote attacker can bypass expected security restrictions.

IBM WebSphere Application Server
IBM Workload Scheduler
Jazz for Service Management
IBM Operations Analytics Predictive Insights
IBM Tivoli Monitoring
Tivoli Network Configuration Manager IP Edition

Install updates from vendor's website.

IBM Tivoli Monitoring - update to 6.3.0.7 Plus Service Pack 5
Tivoli Network Configuration Manager IP Edition - update to 6.4.2.19

• https://www.ibm.com/support/pages/node/7007857

• Security restrictions bypass in IBM WebSphere Application Server
• IBM Operations Analytics Predictive Insights update for IBM WebSphere Application Server
• Multiple vulnerabilities in IBM Tivoli Monitoring
• Configuration vulnerability in IBM Jazz for Service Management (JazzSM)
• Configuration in IBM Workload Scheduler
• Configuration vulnerability in IBM Tivoli Netcool Configuration Manager