CVE-2016-2923: Infoleak
IBM WebSphere Application Server (WAS) 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified JAX-RS API cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2923?
CVE-2016-2923 has a medium severity rating due to its potential risk of sensitive information exposure via insecure cookie handling.
How do I fix CVE-2016-2923?
To fix CVE-2016-2923, ensure you update IBM WebSphere Application Server to Liberty Fix Pack 16.0.0.2 or later.
What versions are affected by CVE-2016-2923?
CVE-2016-2923 affects IBM WebSphere Application Server versions 8.5.5.0 to 8.5.5.9.
What type of vulnerability is CVE-2016-2923?
CVE-2016-2923 is a security vulnerability related to the lack of the HTTPOnly flag in Set-Cookie headers.
Who is impacted by CVE-2016-2923?
Organizations using the affected versions of IBM WebSphere Application Server could be impacted by CVE-2016-2923.