Lucene search

IBM91F4EB0A1F5702357F6B96E701FCAF52861C79365F98BFFA881686230F5F0D5F

HistoryJul 26, 2024 - 1:13 p.m.

Security Bulletin: Multiple Vulnerabilities have been identified in IBM HTTP Server shipped with IBM WebSphere Remote Server.

2024-07-2613:13:30

www.ibm.com

ibm http server

ibm websphere remote server

security bulletin

vulnerability

fixes

apache http server

cve-2024-38472

cve-2024-38473

cve-2024-38474

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

Low

EPSS

0.036

Percentile

91.8%

JSON

Summary

IBM HTTP Server is shipped with IBM WebSphere Remote Server. Information about security vulnerabilities affecting IBM HTTP Server has been published in a security bulletin.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s)	Version(s)
IBM WebSphere Remote Server	9.1, 9.0, 8.5

Remediation/Fixes

BM strongly recommends addressing the vulnerability now. Refer to the following security bulletins for vulnerability details and information about fixes addressed by IBM HTTP Server which is shipped with IBM WebSphere Remote Server.

Principal Product and Version(s)

Affected Supporting Product and Version

Affected Supporting Product Security Bulletin

—|—|—

IBM WebSphere Remote Server 9.1, 9.0, 8.5

IBM HTTP Server 9.0, 8.5

IBM HTTP Server is vulnerable to multiple vulnerabilities due to the included Apache HTTP Server - CVE-2024-38472, CVE-2024-38473, CVE-2024-38474, CVE-2024-38475, CVE-2024-38476, CVE-2024-38477, CVE-2024-39573

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmwebsphere_remote_serverMatch9.1

ibmwebsphere_remote_serverMatch9.0

ibmwebsphere_remote_serverMatch8.5

VendorProductVersionCPE
ibmwebsphere_remote_server9.1cpe:2.3:a:ibm:websphere_remote_server:9.1:*:*:*:*:*:*:*
ibmwebsphere_remote_server9.0cpe:2.3:a:ibm:websphere_remote_server:9.0:*:*:*:*:*:*:*
ibmwebsphere_remote_server8.5cpe:2.3:a:ibm:websphere_remote_server:8.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	websphere_remote_server	9.1	cpe:2.3:a:ibm:websphere_remote_server:9.1:::::::*
ibm	websphere_remote_server	9.0	cpe:2.3:a:ibm:websphere_remote_server:9.0:::::::*
ibm	websphere_remote_server	8.5	cpe:2.3:a:ibm:websphere_remote_server:8.5:::::::*