IBM WebSphere App Server Vulnerability Advisory: SSRF, Auth Bypass, HTTP Smuggling

IBM WebSphere Application Server Security Advisory Summary Vulnerability Overview Versions of IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.31 are affected by multiple vulnerabilities, primarily involving: Authentication Bypass: A remote attacker can exploit this vulnerability through an open redirect attack, redirecting users to a malicious website to obtain sensitive information or launch further attacks (CWE-401: URL Redirection to Untrusted Site) SSRF (Server-Side Request Forgery): By sending a specially crafted HTTP request, an attacker can exploit this vulnerability to send outbound requests to arbitrary endpoints HTTP Request Smuggling: By manipulating the HTTP transfer-encoding request header, an attacker can poison the web cache, bypass the web application firewall, and launch XSS attacks Privilege Escalation: An authenticated user can modify security configurations, leading to information disclosure or service interruption Log Injection: By sending a specially crafted HTTP request, an attacker can inject forged entries into the server administration log Deserialization Vulnerability: The Name Service component contains a deserialization vulnerability XSS (Cross-Site Scripting): By sending a specially crafted unauthenticated request, an attacker can bypass authentication and obtain sensitive information Permission Management Defect: By sending a specially crafted HTTP request, an attacker can exploit this vulnerability to execute arbitrary files Scope of Impact Remediation IBM recommends applying the following fix packs to remediate the vulnerabilities: Traditional IBM WebSphere Application Server - For versions 9.0.0.0 through 9.0.5.28: Apply Fix Pack 9.0.5.29 (available in September 2026) or a subsequent fix pack - For versions 8.5.0.0 through 8.5.30: Apply Fix Pack 8.5.31 (available in September 2026) or a subsequent fix pack Mitigation Measures None (the "Workarounds and Mitigations" section on the page is marked as None) POC/Exploitation Code No POC code or exploitation code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

IBM WebSphere App Server Vulnerability Advisory: SSRF, Auth Bypass, HTTP Smuggling

More from this source