Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM23F8C1E67922626C0589CA86ED9B40D441D494E8B56CD8FF4A2EF76F18E6861F
HistorySep 22, 2022 - 3:02 a.m.

Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2016-1181 and CVE-2016-1182)

2022-09-2203:02:31
www.ibm.com
11
ibm websphere
security bulletin
vulnerabilities
apache struts
maximo asset management
smartcloud control desk
tririga energy optimization
tivoli asset management
change and configuration management database

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

0.428 Medium

EPSS

Percentile

97.4%

JSON

Summary

IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions (including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities), Maximo Adapter for Primavera, SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Change and Configuration Management Database, and TRIRIGA Energy Optimization. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin.

Vulnerability Details

Please consult the Security Bulletin: Vulnerabilities in Apache Struts affects IBM WebSphere Application Server (CVE-2016-1181 and CVE-2016-1182) for vulnerability details and information about fixes.

Affected Products and Versions

Principal Product and Version(s)

| Affected Supporting Product and Version
—|—
Maximo Asset Management 7.6
SmartCloud Control Desk 7.6
Maximo for Life Sciences 7.6
Maximo for Transportation 7.6| IBM WebSphere Application Server 8.5.5 Full Profile
IBM WebSphere Application Server 8.5 Full Profile
Maximo Asset Management 7.5
Maximo Asset Management Essentials 7.5
Maximo for Government 7.5
Maximo for Nuclear Power 7.5
Maximo for Transportation 7.5
Maximo for Life Sciences 7.5
Maximo for Oil and Gas 7.5
Maximo for Utilities 7.5
Maximo Adapter for Primavera 7.5
SmartCloud Control Desk 7.5
TRIRIGA Energy Optimization 1.1| IBM WebSphere Application Server 8.5.5 Full Profile
IBM WebSphere Application Server 8.5 Full Profile
IBM WebSphere Application Server 8.0
IBM WebSphere Application Server 7.0
Maximo Asset Management 7.1
Maximo Asset Management Essentials 7.1
Maximo Asset Management for Energy Optimization 7.1
Maximo for Government 7.1
Maximo for Nuclear Power 7.1
Maximo for Transportation 7.1
Maximo for Life Sciences 7.1
Maximo for Oil and Gas 7.1
Maximo for Utilities 7.1
Maximo Adapter for Primavera 7.1| IBM WebSphere Application Server 7.0
Tivoli Asset Management for IT 7.2
Tivoli Service Request Manager 7.2
Change and Configuration Management Database 7.2| IBM WebSphere Application Server 8.5.5 Full Profile
IBM WebSphere Application Server 7.0

Affected configurations

Vulners
Node
ibmmaximo_asset_managementMatch7.1
OR
ibmmaximo_asset_managementMatch7.1.1
OR
ibmmaximo_asset_managementMatch7.5
OR
ibmmaximo_asset_managementMatch7.6
OR
ibmcontrol_deskMatch7.5
OR
ibmcontrol_deskMatch7.5.1
OR
ibmcontrol_deskMatch7.5.1.1
OR
ibmcontrol_deskMatch7.5.1.2
OR
ibmcontrol_deskMatch7.5.3
OR
ibmcontrol_deskMatch7.6.0
OR
ibmmaximo_for_energy_optimizationMatchany
OR
ibmmaximo_asset_management_essentialsMatch7.5
OR
ibmmaximo_asset_management_essentialsMatch7.1.1
OR
ibmmaximo_for_energy_optimizationMatch7.1
OR
ibmmaximo_for_energy_optimizationMatch7.1.1
OR
ibmmaximo_for_governmentMatch7.1
OR
ibmmaximo_for_governmentMatch7.1.1
OR
ibmmaximo_for_governmentMatch7.5
OR
ibmmaximo_for_life_sciencesMatch7.1.2
OR
ibmmaximo_for_life_sciencesMatch7.5
OR
ibmmaximo_for_life_sciencesMatch7.1.0
OR
ibmmaximo_for_life_sciencesMatch7.6
OR
ibmmaximo_for_nuclear_powerMatch7.1
OR
ibmmaximo_for_nuclear_powerMatch7.5
OR
ibmmaximo_for_nuclear_powerMatch7.5.1
OR
ibmmaximo_for_nuclear_powerMatch7.1.1
OR
ibmmaximo_for_oil_and_gasMatch7.1.2
OR
ibmmaximo_for_oil_and_gasMatch7.5
OR
ibmmaximo_for_oil_and_gasMatch7.5.1
OR
ibmmaximo_for_oil_and_gasMatch7.1.0
OR
ibmmaximo_for_transportationMatch7.1.0
OR
ibmmaximo_for_transportationMatch7.1.1
OR
ibmmaximo_for_transportationMatch7.5
OR
ibmmaximo_for_transportationMatch7.5.1
OR
ibmmaximo_for_transportationMatch7.6.1
OR
ibmmaximo_for_utilitiesMatch7.1.1
OR
ibmmaximo_for_utilitiesMatch7.1.2
OR
ibmmaximo_for_utilitiesMatch7.5
OR
ibmmaximo_for_utilitiesMatch7.1.0
OR
ibmmaximo_asset_managementMatch7.2
OR
ibmmaximo_asset_managementMatch7.2.1
OR
ibmmaximo_asset_managementMatch7.2.2
OR
ibmtivoli_change_and_configuration_management_databaseMatch7.2
OR
ibmtivoli_change_and_configuration_management_databaseMatch7.2.1
OR
ibmtivoli_service_request_managerMatch7.2
OR
ibmtivoli_service_request_managerMatch7.2.1

Related

nessus 10
openvas 6
fedora 2
ibm 66
mageia 1
jvn 2
symantec 1
f5 4
redhatcve 2
osv 2
ubuntucve 2
github 2
cve 2
prion 2
nvd 2
cvelist 2
checkpoint_advisories 1
ics 1
oracle 14
nessus
nessus
Fedora 24 : struts (2016-d717fdcf74)
2016-07-15 00:00:00
Fedora 23 : struts (2016-21bd6a33af)
2016-07-15 00:00:00
RHEL 5 : struts (Unpatched Vulnerability)
2024-05-11 00:00:00
openvas
openvas
Fedora Update for struts FEDORA-2016-d717fdcf74
2016-07-02 00:00:00
Fedora Update for struts FEDORA-2016-21bd6a33af
2016-07-02 00:00:00
Mageia: Security Advisory (MGASA-2016-0244)
2022-01-28 00:00:00
fedora
fedora
[SECURITY] Fedora 23 Update: struts-1.3.10-18.fc23
2016-06-30 19:54:11
[SECURITY] Fedora 24 Update: struts-1.3.10-18.fc24
2016-06-30 21:31:48
ibm
ibm
Security Bulletin: Vulnerabilities in Struts v2 affect IBM Spectrum Control (formerly Tivoli Storage Productivity Center) CVE-2016-1181, CVE-2016-1182
2022-02-22 19:50:07
Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server that is shipped with IBM Intelligent Operations Center and related products (CVE-2016-1181 and CVE-2016-1182)
2022-08-19 21:04:31
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Security Key Lifecycle Manager (SKLM) (CVE-2016-1181 and CVE-2016-1182)
2018-06-16 21:44:41
mageia
mageia
Updated struts packages fix security vulnerabilities
2016-07-08 22:50:50
jvn
jvn
JVN#03188560: Apache Struts 1 vulnerability that allows unintended remote operations against components on memory
2016-06-07 00:00:00
JVN#65044642: Apache Struts 1 vulnerable to input validation bypass
2016-06-07 00:00:00
symantec
symantec
Apache Struts CVE-2016-1181 Remote Code Execution Vulnerability
2016-06-07 00:00:00
f5
f5
SOL40444230 - Apache Struts 1 vulnerability CVE-2016-1181
2016-06-13 00:00:00
K40444230 : Apache Struts 1 vulnerability CVE-2016-1181
2016-06-14 00:00:00
K04403302 : Apache Struts 1 vulnerability CVE-2016-1182
2016-06-16 00:00:00
redhatcve
redhatcve
CVE-2016-1181
2016-06-07 12:48:28
CVE-2016-1182
2016-06-07 12:48:33
osv
osv
Improper Input Validation in Apache Struts
2022-05-13 01:25:20
Improper Input Validation in Apache Struts
2022-05-13 01:25:19
ubuntucve
ubuntucve
CVE-2016-1181
2016-07-04 00:00:00
CVE-2016-1182
2016-07-04 00:00:00
github
github
Improper Input Validation in Apache Struts
2022-05-13 01:25:20
Improper Input Validation in Apache Struts
2022-05-13 01:25:19
cve
cve
CVE-2016-1181
2016-07-04 22:59:01
CVE-2016-1182
2016-07-04 22:59:02
prion
prion
Design/Logic Flaw
2016-07-04 22:59:00
Cross site scripting
2016-07-04 22:59:00
nvd
nvd
CVE-2016-1181
2016-07-04 22:59:01
CVE-2016-1182
2016-07-04 22:59:02
cvelist
cvelist
CVE-2016-1181
2016-07-04 22:00:00
CVE-2016-1182
2016-07-04 22:00:00
checkpoint_advisories
checkpoint_advisories
Multiple Webservers Cross-Site Scripting Attempt (CVE-2015-0899; CVE-2016-1182)
2017-12-20 00:00:00
ics
ics
OpenClinic GA (Update B)
2021-06-15 12:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - January 2019
2019-01-15 00:00:00
Oracle Critical Patch Update - January 2018
2018-01-16 00:00:00
Oracle Critical Patch Update - October 2016
2016-10-18 00:00:00

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

0.428 Medium

EPSS

Percentile

97.4%

JSON
Related for 23F8C1E67922626C0589CA86ED9B40D441D494E8B56CD8FF4A2EF76F18E6861F
nessus10openvas6fedora2ibm66mageia1jvn2symantec1f54redhatcve2osv2ubuntucve2github2cve2prion2nvd2cvelist2checkpoint_advisories1ics1oracle14