Lucene search

IBM263D7DE2C25219723093A5D9884DCA83654D703403795537E8EADA7E806E2A7E

HistoryJul 26, 2024 - 1:14 p.m.

Security Bulletin: Multiple Vulnerabilities have been identified in IBM HTTP Server shipped with IBM WebSphere Remote Server (CVE-2024-40898, CVE-2024-40725)

2024-07-2613:14:49

www.ibm.com

ibm http server

ibm websphere remote server

security bulletin

vulnerabilities

fixes

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

0.001

Percentile

38.6%

JSON

Summary

IBM HTTP Server is shipped with IBM WebSphere Remote Server. Information about security vulnerabilities affecting IBM HTTP Server has been published in a security bulletin.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s)	Version(s)
IBM WebSphere Remote Server	9.1, 9.0, 8.5

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now. Refer to the following security bulletins for vulnerability details and information about fixes addressed by IBM HTTP Server which is shipped with IBM WebSphere Remote Server.

Principal Product and Version(s)

Affected Supporting Product and Version

Affected Supporting Product Security Bulletin

—|—|—

IBM WebSphere Remote Server 9.1, 9.0, 8.5

IBM HTTP Server 9.0, 8.5

IBM HTTP Server is vulnerable to multiple vulnerabilities due to the included Apache HTTP Server (CVE-2024-40898, CVE-2024-40725)

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmwebsphere_remote_serverMatch9.1

ibmwebsphere_remote_serverMatch9.0

ibmwebsphere_remote_serverMatch8.5

VendorProductVersionCPE
ibmwebsphere_remote_server9.1cpe:2.3:a:ibm:websphere_remote_server:9.1:*:*:*:*:*:*:*
ibmwebsphere_remote_server9.0cpe:2.3:a:ibm:websphere_remote_server:9.0:*:*:*:*:*:*:*
ibmwebsphere_remote_server8.5cpe:2.3:a:ibm:websphere_remote_server:8.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	websphere_remote_server	9.1	cpe:2.3:a:ibm:websphere_remote_server:9.1:::::::*
ibm	websphere_remote_server	9.0	cpe:2.3:a:ibm:websphere_remote_server:9.0:::::::*
ibm	websphere_remote_server	8.5	cpe:2.3:a:ibm:websphere_remote_server:8.5:::::::*