Vulnerability CVE-2015-1932 - CERT Civis.Net

Vulnerability Name:

CVE-2015-1932 (CCN-102970)

Assigned:

2015-08-17

Published:

2015-08-17

Updated:

2017-09-20

Summary:

IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2015-1932

Source: AIXAPAR
Type: UNKNOWN
PI38403

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21963275

Source: CCN
Type: IBM Security Bulletin 1963275
Multiple Security Vulnerabilities fixed in IBM WebSphere Application Server 8.0.0.11

Source: CCN
Type: IBM Security Bulletin 1971307
IBM Tivoli Monitoring embedded WebSphere Application Server (CVE-2015-7450, CVE-2015-2017, CVE-2015-4938, CVE-2015-1932, CVE-2015-1927 )

Source: CCN
Type: IBM Security Bulletin C1000043
A security vulnerability has been identified in IBM Business Process Manager and IBM HTTP Server shipped with IBM Cloud Orchestrator (CVE-2015-1932, CVE-2015-4938)

Source: BID
Type: UNKNOWN
76466

Source: SECTRACK
Type: UNKNOWN
1033325

Source: XF
Type: UNKNOWN
ibm-websphere-cve20151932-info-disc(102970)

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:websphere_virtual_enterprise:*:*:*:*:*:*:*:* (Version <= 7.0.0.6)

Configuration 2:

cpe:/a:ibm:websphere_application_server:7.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.9:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.10:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.11:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.12:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.13:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.14:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.15:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.16:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.17:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.18:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.19:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.21:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.22:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.23:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.24:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.25:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.27:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.29:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.31:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.32:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.33:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.34:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.36:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.37:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.38:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.0.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.0.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.0.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.0.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.0.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.0.0.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.0.0.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.0.0.9:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.0.0.10:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.5.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.5.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.5.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.5.6:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.5:*:*:*:*:*:*:*

AND

cpe:/a:ibm:cloud_orchestrator:2.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.2.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_monitoring:6.3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_orchestrator:2.4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_orchestrator:2.4.0.2:*:*:*:*:*:*:*

Denotes that component is vulnerable