#VU71483 Inadequate Encryption Strength in IBM WebSphere Application Server


Published: 2023-01-24

Vulnerability identifier: #VU71483

Vulnerability risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-43917

CWE-ID: CWE-326

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
IBM WebSphere Application Server
Server applications / Application servers

Vendor: IBM Corporation

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the IBM WebSphere Application Server traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information.A remote attacker can gain access to sensitive information.

Note, this affects only the containerized version of WebSphere Application Server traditional.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

IBM WebSphere Application Server: 9.0.0.9 - 9.0.5.14, 8.5.5.17 - 8.5.5.22


External links
http://www.ibm.com/support/pages/node/6857007


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability