MitM attack in IBM WebSphere Application Server Liberty Web Server Plug-ins

1) Improper validation of certificate with host mismatch

EUVDB-ID: #VU75686

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-39161

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

Exploit availability: No

Description

The vulnerability allows a remote user to perform MitM attack.

The vulnerability exists due to improper certificate validation issued by a trusted CA when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server. A remote user can perform a man-in-the-middle (MitM) attack and gain access to sensitive information.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

IBM WebSphere Application Server Liberty: 17.0.0.3 - 23.0.0.4

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_websphere_application_server_liberty:17.0.0.3:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_websphere_application_server_liberty:17.0.0.4:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_websphere_application_server_liberty:18.0.0.0:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/6987779

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.