CVE-2016-2961

MEDIUM

IBM Integration Bus 9-10 and WebSphere Message Broker 8 - Sensitive Information Exposure via Malformed POST Request

Title source: llm
STIX 2.1

Description

The integration server in IBM Integration Bus 9 before 9.0.0.6 and 10 before 10.0.0.5 and WebSphere Message Broker 8 before 8.0.0.8 allows remote attackers to obtain sensitive Tomcat version information by sending a malformed POST request and then reading the Java stack trace.

References (2)

Core 2
Core References
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21985017
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IT15188

Scores

CVSS v3 5.3
EPSS 0.0147
EPSS Percentile 70.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-200
Status published
Products (19)
ibm/integration_bus 9.0
ibm/integration_bus 9.0.0.1
ibm/integration_bus 9.0.0.2
ibm/integration_bus 9.0.0.3
ibm/integration_bus 9.0.0.4
ibm/integration_bus 9.0.0.5
ibm/integration_bus 10.0
ibm/integration_bus 10.0.0.1
ibm/integration_bus 10.0.0.2
ibm/integration_bus 10.0.0.3
... and 9 more
Published Jul 02, 2016
Tracked Since Feb 18, 2026