Security Bulletin: Websphere Message Broker and IBM Integration Bus are affected by error handling vulnerability

Summary

WebSphere Message Broker and IBM Integration Bus; web user interface error page returns detailed error information.

Vulnerability Details

**CVE-ID:*CVE-2014-4819
CVSS Base Score: 4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/95456&gt; for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:P/I:N/A:N)

Affected Products and Versions

WebSphere Message Broker V8.0

IBM Integration Bus V9.0

Remediation/Fixes

Apply APAR IT03097

For IBM Integration Bus V9.0, the APAR is targeted to be available in fix pack 9.0.0.3
For WebSphere Message Broker V8.0, the APAR is targeted to be available in fix pack 8.0.0.6

Prior to fix pack availability the APAR can be obtained on request from IBM Support.

Workarounds and Mitigations

None known