Description
IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, 8.5.x before 8.5.5.11, 9.0.x before 9.0.0.2, and Liberty before 16.0.0.3 mishandles responses, which allows remote attackers to obtain sensitive information via unspecified vectors.
References (4)
Core 4
Core References
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21990056
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/93013
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1036838
Not Applicable vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1PI67093
Scores
CVSS v3
7.5
EPSS
0.0242
EPSS Percentile
82.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-200
Status
published
Products (50)
ibm/websphere_application_server
7.0
ibm/websphere_application_server
7.0.0.0
ibm/websphere_application_server
7.0.0.1
ibm/websphere_application_server
7.0.0.2
ibm/websphere_application_server
7.0.0.3
ibm/websphere_application_server
7.0.0.4
ibm/websphere_application_server
7.0.0.5
ibm/websphere_application_server
7.0.0.6
ibm/websphere_application_server
7.0.0.7
ibm/websphere_application_server
7.0.0.8
... and 40 more
Published
Oct 01, 2016
Tracked Since
Feb 18, 2026