Use of a broken or risky cryptographic algorithm in IBM WebSphere Application Server - CVE-2023-50313

Vulnerability identifier: #VU88120

CSH Severity: Low

CVSS v4: 5.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-50313

CWE-ID: CWE-327

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows an attacker in adjacent network to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. An attacker in adjacent network can gain unauthorized access to sensitive information on the system.

IBM WebSphere Application Server
IBM Business Automation Workflow
IBM Rational ClearQuest
IBM Rational ClearCase
WebSphere Service Registry and Repository
IBM Tivoli System Automation Application Manager
IBM Tivoli Netcool/OMNIbus WebGUI
IBM Operations Analytics Predictive Insights
IBM Intelligent Operations Center
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Maximo Asset Management
WebSphere Remote Server
IBM Security Verify Governance
InfoSphere Master Data Management
Jazz for Service Management
IBM Tivoli Monitoring
IBM Maximo Application Suite - Manage Component
Intelligent Operations Center for Emergency Management
Tivoli Composite Application Manager for Application Diagnostics
Business Monitor

Install updates from vendor's website.

Jazz for Service Management - update to 1.1.3.21
IBM Tivoli Monitoring - update to 6.3.0.7 Plus Service Pack 5
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.17, 8.7.11

• https://www.ibm.com/support/pages/node/7145620
• https://exchange.xforce.ibmcloud.com/vulnerabilities/274812

• Use of a broken or risky cryptographic algorithm in IBM WebSphere Application Server
• Use of a broken or risky cryptographic algorithm in IBM Buinses Automation Workflow
• Use of a broken or risky cryptographic algorithm in IBM Rational ClearQuest
• Use of a broken or risky cryptographic algorithm in IBM WebSphere Application Server
• Use of a broken or risky cryptographic algorithm in WebSphere Service Registry and Repository
• Use of a broken or risky cryptographic algorithm in IBM Intelligent Operations Center for Emergency Management
• Use of a broken or risky cryptographic algorithm in IBM WebSphere Application Server
• Use of a broken or risky cryptographic algorithm in IBM Tivoli Netcool/OMNIbus WebGUI
• Multiple vulnerabilities in IBM Security Verify Governance, Identity Manager
• Use of a broken or risky cryptographic algorithm in IBM Tivoli Composite Application Manager for Application Diagnostics
• Use of a broken or risky cryptographic algorithm in IBM Tivoli System Automation Application Manager
• Use of a broken or risky cryptographic algorithm in IBM Asset and Service Management
• Multiple vulnerabilities in IBM Operations Analytics Predictive Insights
• Use of a broken or risky cryptographic algorithm in IBM Security Guardium Key Lifecycle Manager
• Multiple vulnerabilities in IBM Tivoli Monitoring
• Use of a broken or risky cryptographic algorithm in IBM WebSphere Application Server
• Multiple vulnerabilities in IBM Rational ClearCase
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in IBM Business Monitor