CVE-2017-1151: High severity IBM WebSphere Application Server Feature Pack for Web Services vulnerability
IBM WebSphere Application Server 8.0, 8.5, 8.5.5, and 9.0 using OpenID Connect (OIDC) configured with a Trust Association Interceptor (TAI) could allow a user to gain elevated privileges on the system. IBM Reference #: 1999293.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Review and restrict use of WebSphere Application Server OpenID Connect (OIDC) configured with a Trust Association Interceptor (TAI) until the referenced IBM fix for IBM Reference #: 1999293 is applied, as this configuration could allow elevated privileges.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1151?
CVE-2017-1151 is classified as a high severity vulnerability due to its potential to allow elevation of privileges.
How do I fix CVE-2017-1151?
To resolve CVE-2017-1151, you should upgrade to the latest supported version of IBM WebSphere Application Server.
What versions of IBM WebSphere Application Server are affected by CVE-2017-1151?
CVE-2017-1151 affects IBM WebSphere Application Server versions 8.0, 8.5, 8.5.5, and 9.0.
What is the impact of CVE-2017-1151 on a system?
The impact of CVE-2017-1151 could allow unauthorized users to gain elevated privileges in the system.
Is there a workaround for CVE-2017-1151 if I can't upgrade?
There are no documented workarounds for CVE-2017-1151, and upgrading is recommended as the only solution.