CERT-In Vulnerability Note
CIVN-2021-0372
Multiple vulnerabilities in IBM WebSphere Application Server
Original Issue Date:December 28, 2021
Severity Rating: HIGH
Software Affected
- WebSphere Application Server 7.0
- WebSphere Application Server 8.0
- WebSphere Application Server 8.5
- WebSphere Application Server 9.0
Overview
Multiple vulnerabilities have been reported in IBM WebSphere Application Server which could allow a remote attacker to execute arbitrary code and perform denial of service condition on the targeted system.
Description
1. Remote Code execution Vulnerability
(
CVE-2021-4104
)
This vulnerability exists in WebSphere Application Server due to deserialization of untrusted data in the Log4j configuration. A remote attacker could execute code on the server if the deployed application is configured to use JMSAppender.
Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the targeted system.
2. Denial of Service (DoS) Vulnerability
(
CVE-2021-45046
)
This vulnerability exists in WebSphere Application Server due to Log4j logging library. A remote attacker could control over Thread Context Map (MDC) input data and craft malicious input using a JNDI Lookup pattern.
Successful exploitation of this vulnerability could allow a remote attacker to perform denial of service condition on the targeted system.
Solution
Upgrade to latest versions as mentioned in IBM Support:
https://www.ibm.com/support/pages/node/6526750
Vendor Information
IBM
https://www.ibm.com/support/pages/node/6526750
References
IBM
https://www.ibm.com/support/pages/node/6526750
CVE Name
CVE-2021-4104
CVE-2021-45046
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|