{ "document" : { "aggregate_severity" : { "text" : "mittel" }, "category" : "csaf_base", "csaf_version" : "2.0", "distribution" : { "tlp" : { "label" : "WHITE", "url" : "https://www.first.org/tlp/" } }, "lang" : "de-DE", "notes" : [ { "category" : "legal_disclaimer", "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen." }, { "category" : "description", "text" : "IBM WebSphere Application Server ist ein J2EE-Applikationsserver.", "title" : "Produktbeschreibung" }, { "category" : "summary", "text" : "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM WebSphere Application Server ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.", "title" : "Angriff" }, { "category" : "general", "text" : "- Linux\n- MacOS X\n- Sonstiges\n- UNIX\n- Windows", "title" : "Betroffene Betriebssysteme" } ], "publisher" : { "category" : "other", "contact_details" : "csaf-provider@cert-bund.de", "name" : "Bundesamt für Sicherheit in der Informationstechnik", "namespace" : "https://www.bsi.bund.de" }, "references" : [ { "category" : "self", "summary" : "WID-SEC-W-2024-0716 - CSAF Version", "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0716.json" }, { "category" : "self", "summary" : "WID-SEC-2024-0716 - Portal Version", "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0716" }, { "category" : "external", "summary" : "IBM Security Bulletin vom 2024-03-26", "url" : "https://www.ibm.com/support/pages/node/7145231" }, { "category" : "external", "summary" : "IBM Security Bulletin 7150669 vom 2024-05-09", "url" : "https://www.ibm.com/support/pages/node/7150669" }, { "category" : "external", "summary" : "IBM Security Bulletin 7156270 vom 2024-06-03", "url" : "https://www.ibm.com/support/pages/node/7156270" }, { "category" : "external", "summary" : "HCL Article KB0113892 vom 2024-07-01", "url" : "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113892" }, { "category" : "external", "summary" : "IBM Security Bulletin 7169557 vom 2024-09-20", "url" : "https://www.ibm.com/support/pages/node/7169557" }, { "category" : "external", "summary" : "HCL Security Advisory", "url" : "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0115352" } ], "source_lang" : "en-US", "title" : "IBM WebSphere Application Server: Schwachstelle ermöglicht Cross-Site Scripting", "tracking" : { "current_release_date" : "2024-11-18T23:00:00.000+00:00", "generator" : { "date" : "2024-11-19T12:09:56.365+00:00", "engine" : { "name" : "BSI-WID", "version" : "1.3.8" } }, "id" : "WID-SEC-W-2024-0716", "initial_release_date" : "2024-03-26T23:00:00.000+00:00", "revision_history" : [ { "date" : "2024-03-26T23:00:00.000+00:00", "number" : "1", "summary" : "Initiale Fassung" }, { "date" : "2024-05-09T22:00:00.000+00:00", "number" : "2", "summary" : "Neue Updates von IBM aufgenommen" }, { "date" : "2024-06-03T22:00:00.000+00:00", "number" : "3", "summary" : "Neue Updates von IBM aufgenommen" }, { "date" : "2024-06-30T22:00:00.000+00:00", "number" : "4", "summary" : "Neue Updates von HCL aufgenommen" }, { "date" : "2024-09-19T22:00:00.000+00:00", "number" : "5", "summary" : "Neue Updates von IBM aufgenommen" }, { "date" : "2024-11-03T23:00:00.000+00:00", "number" : "6", "summary" : "Neue Updates von HCL aufgenommen" }, { "date" : "2024-11-18T23:00:00.000+00:00", "number" : "7", "summary" : "Prüfung Produkteintragung" } ], "status" : "final", "version" : "7" } }, "product_tree" : { "branches" : [ { "branches" : [ { "branches" : [ { "category" : "product_version", "name" : "Compliance v2.0.x", "product" : { "name" : "HCL BigFix Compliance v2.0.x", "product_id" : "T035699", "product_identification_helper" : { "cpe" : "cpe:/a:hcltech:bigfix:v2.0.x::compliance" } } } ], "category" : "product_name", "name" : "BigFix" }, { "branches" : [ { "category" : "product_version", "name" : "9.0-9.0.1.21", "product" : { "name" : "HCL Commerce 9.0-9.0.1.21", "product_id" : "T038746", "product_identification_helper" : { "cpe" : "cpe:/a:hcltechsw:commerce:9.0_-_9.0.1.21" } } }, { "category" : "product_version", "name" : "9.1.0-9.1.15", "product" : { "name" : "HCL Commerce 9.1.0-9.1.15", "product_id" : "T038747", "product_identification_helper" : { "cpe" : "cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.15" } } } ], "category" : "product_name", "name" : "Commerce" } ], "category" : "vendor", "name" : "HCL" }, { "branches" : [ { "category" : "product_name", "name" : "IBM Business Automation Workflow", "product" : { "name" : "IBM Business Automation Workflow", "product_id" : "T019704", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:business_automation_workflow:-" } } }, { "branches" : [ { "category" : "product_version", "name" : "Collaboration and Deployment Services", "product" : { "name" : "IBM SPSS Collaboration and Deployment Services", "product_id" : "T037766", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:spss:collaboration_and_deployment_services" } } } ], "category" : "product_name", "name" : "SPSS" }, { "branches" : [ { "category" : "product_version", "name" : "for Multiplatforms 9.1", "product" : { "name" : "IBM TXSeries for Multiplatforms 9.1", "product_id" : "T015903", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:txseries:for_multiplatforms_9.1" } } }, { "category" : "product_version", "name" : "for Multiplatforms 8.2", "product" : { "name" : "IBM TXSeries for Multiplatforms 8.2", "product_id" : "T015904", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:txseries:for_multiplatforms_8.2" } } }, { "category" : "product_version", "name" : "for Multiplatforms 8.1", "product" : { "name" : "IBM TXSeries for Multiplatforms 8.1", "product_id" : "T015905", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:txseries:for_multiplatforms_8.1" } } } ], "category" : "product_name", "name" : "TXSeries" }, { "branches" : [ { "category" : "product_version_range", "name" : "Liberty <24.0.0.4", "product" : { "name" : "IBM WebSphere Application Server Liberty <24.0.0.4", "product_id" : "T033686" } }, { "category" : "product_version", "name" : "Liberty 24.0.0.4", "product" : { "name" : "IBM WebSphere Application Server Liberty 24.0.0.4", "product_id" : "T033686-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:websphere_application_server:liberty__24.0.0.4" } } }, { "category" : "product_version", "name" : "23.0.0.3-24.0.0.3", "product" : { "name" : "IBM WebSphere Application Server 23.0.0.3-24.0.0.3", "product_id" : "T033689", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:websphere_application_server:23.0.0.3_-_24.0.0.3" } } } ], "category" : "product_name", "name" : "WebSphere Application Server" } ], "category" : "vendor", "name" : "IBM" } ] }, "vulnerabilities" : [ { "cve" : "CVE-2024-27270", "notes" : [ { "category" : "description", "text" : "In IBM WebSphere Application Server existiert eine Cross-Site Scripting Schwachstelle. HTML und Script-Eingaben werden nicht ordnungsgemäß überprüft, bevor sie an den Benutzer zurückgegeben werden. Ein entfernter, anonymer Angreifer kann durch Ausnutzung dieser Schwachstelle beliebigen HTML- und Script-Code durch den Browser des Benutzers im Kontext der betroffenen Seite ausführen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status" : { "known_affected" : [ "T015905", "T033689", "T015904", "T033686", "T015903", "T035699", "T038747", "T038746", "T019704", "T037766" ] }, "release_date" : "2024-03-26T23:00:00.000+00:00", "title" : "CVE-2024-27270" } ] }