Resource exhaustion in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - CVE-2024-25026

Vulnerability identifier: #VU88977

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2024-25026

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
IBM WebSphere Application Server
IBM WebSphere Application Server Liberty
IBM Rational ClearCase
Engineering Workflow Management
IBM Security Access Manager for Enterprise Single-Sign On
IBM Business Automation Workflow
Jazz for Service Management
Log Analysis
IBM Operations Analytics Predictive Insights
IBM Intelligent Operations Center
IBM MQ Operator
IBM SPSS Analytic Server
IBM Tivoli System Automation Application Manager
IBM Sterling B2B Integrator
IBM Tivoli Netcool Impact
IBM Spectrum Symphony
WebSphere Remote Server
WebSphere Service Registry and Repository
IBM Rational ClearQuest
CICS Transaction Gateway
IBM Transformation Extender Advanced
IBM Security Verify Governance
InfoSphere Master Data Management
IBM Robotic Process Automation
IBM Cloud Application Business Insights
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Match 360
IBM Spectrum Control
IBM Elastic Storage System
IBM Tivoli Monitoring
IBM Maximo Asset Management
IBM Cloud Application Performance Management (APM)
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite - Manage Component
IBM Maximo Application Suite
IBM Common Licensing
IBM TXSeries for Multiplatforms
IBM MQ
IBM Security Verify Governance - Containerized Identity Manager
IBM Cloud Pak for Business Automation
Jazz Foundation
IBM CICS TX Advanced
IBM CICS TX Standard
IBM Engineering Requirements Management DOORS Next
Engineering Test Management
Intelligent Operations Center for Emergency Management
Data Product Hub
Tivoli Composite Application Manager for Application Diagnostics
IBM OpenPages with Watson
Business Monitor
PowerVM NovaLink
IBM Planning Analytics Workspace
Answer Retrieval for Watson Discovery On Prem
IBM Watson Machine Learning Accelerator
Storage Protect for Virtual Environments: Data Protection for VMware
Storage Protect for Space Management
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Storage Protect Client
Storage Protect Operations Center
Maximo Application Suite - Monitor Component
IBM Virtualization Engine TS7700 3948-VED
Maximo Application Suite - Predict Component
IBM Workload Automation
Business Automation Insights
IBM Cloud Pak System
IBM i
IBM Tivoli Application Dependency Discovery Manager
IBM Cognos Controller
Financial Transaction Manager
IBM License Metric Tool
Voice Gateway
Planning Analytics Local
IBM Cognos Analytics
IBM Storage Scale System
Virtualization Engine TS7700 3957-VED
IBM InfoSphere Information Server
IBM Watson Explorer Foundational Components

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling HTTP requests. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install updates from vendor's website.

• https://www.ibm.com/support/pages/node/7149330