CVE-2016-2945

HIGH

IBM WebSphere Application Server 8.5.5.8-8.5.5.9 - Authenticated Privilege Escalation via Swagger External Reference

Title source: llm

Description

The API Discovery implementation in IBM WebSphere Application Server (WAS) 8.5.5.8 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to gain privileges via an external reference in a Swagger document.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/91517

Vendor Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21984502

Various Sources vendor-advisory x_refsource_aixapar

http://www-01.ibm.com/support/docview.wss?uid=swg1PI62450

Scores

CVSS v3 7.5

EPSS 0.0185

EPSS Percentile 76.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-264

Status published

Products (2)

ibm/websphere_application_server 8.5.5.8

ibm/websphere_application_server 8.5.5.9

Published Jul 08, 2016

Tracked Since Feb 18, 2026