CVE-2018-1755

MEDIUM

IBM WebSphere Application Server Liberty - Sensitive Information Exposure via JASPIC Authentication

Title source: llm

Description

IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by incorrect transport being used when Liberty is configured to use Java Authentication SPI for Containers (JASPIC). This can happen when the Application Server is configured to permit access on non-secure (http) port and using JASPIC or JSR375 authentication.

References (4)

Core 4

Core References

VDB Entry, Vendor Advisory vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/148597

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1041558

Patch, Vendor Advisory x_refsource_confirm

https://www.ibm.com/support/docview.wss?uid=ibm10728689

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/105150

Scores

CVSS v3 5.9

EPSS 0.0348

EPSS Percentile 87.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (1)

ibm/websphere_application_server

Published Aug 24, 2018

Tracked Since Feb 18, 2026