CVE-2023-38737: IBM WebSphere Application Server Liberty denial of service
First published: Wed Aug 16 2023(Updated: )
Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity (XXE) declarations by the XmlParser. By sending a specially crafted request, an attacker could exploit this vulnerability to conduct SSRF attack or cause a denial of service condition.
Credit: psirt@us.ibm.com psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ibm Websphere Application Server | >=22.0.0.13<=23.0.0.7 | |
| IBM Cognos Analytics | <=12.0.0-12.0.3 | |
| IBM Cognos Analytics | <=11.2.0-11.2.4 FP3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-38737.
What is the severity level of CVE-2023-38737?
The severity level of CVE-2023-38737 is high (7.5).
How does CVE-2023-38737 impact IBM WebSphere Application Server Liberty?
CVE-2023-38737 can cause denial of service by consuming memory resources on IBM WebSphere Application Server Liberty versions 22.0.0.13 through 23.0.0.7.
How can this vulnerability be exploited?
This vulnerability can be exploited by sending a specially-crafted request.
Is there a fix available for CVE-2023-38737?
Yes, IBM has provided a fix for CVE-2023-38737. Please refer to the IBM support page for more information.
- collector/nvd-api
- collector/nvd-index
- agent/author
- agent/type
- agent/remedy
- agent/title
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/event
- agent/first-publish-date
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/softwarecombine
- agent/tags
- agent/description
- agent/trending
- vendor/ibm
- canonical/ibm websphere application server
- version/ibm websphere application server/22.0.0.13
- version/ibm websphere application server/23.0.0.7
- canonical/ibm cognos analytics
- version/ibm cognos analytics/12.0.0-12.0.3
- version/ibm cognos analytics/11.2.0-11.2.4 fp3