Vulnerability Name:

CVE-2021-38951 (CCN-211405)

Assigned:2021-12-08
Published:2021-12-08
Updated:2022-07-12
Summary:IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available CPU resources. IBM X-Force ID: 211405.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2021-38951

Source: XF
Type: UNKNOWN
ibm-websphere-cve202138951-dos(211405)

Source: XF
Type: VDB Entry, Vendor Advisory
ibm-websphere-cve202138951-dos (211405)

Source: CCN
Type: IBM Security Bulletin 6524674 (WebSphere Application Server)
WebSphere Application Server is vulnerable to a Denial of Service (CVE-2021-38951)

Source: CONFIRM
Type: Vendor Advisory
https://www.ibm.com/support/pages/node/6524674

Source: CCN
Type: IBM Security Bulletin 6538414 (Tivoli Monitoring V6)
Multiple vulnerabilities affect IBM Tivoli Monitoring Installed WebSphere Application Server including Log4j

Source: CCN
Type: IBM Security Bulletin 6555550 (InfoSphere Master Data Management)
Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Master Data Management

Source: CCN
Type: IBM Security Bulletin 6562895 (Content Collector for Email)
WebSphere Application Server is vulnerable to a Privilege Escalation vulnerability and affects Content Collector for Email

Source: CCN
Type: IBM Security Bulletin 6565759 (Security Verify Governance)
IBM Security Verify Governance, Identity Manager virtual appliance component is vulnerable to denial of service (CVE-2021-38951)

Source: CCN
Type: IBM Security Bulletin 6612331 (Security Identity Manager Virtual Appliance)
IBM Security Identity Manager Virtual Appliance is vulnerable to arbitrary code execution due to Apache Log4j and other issues (CVE-2021-4104, CVE-2021-45046, CVE-2021-38951)

Source: CCN
Type: IBM Security Bulletin 6997587 (Security Directory Server)
Multiple Security Vulnerabilities have been fixed in the IBM Directory Server and IBM Directory Suite products (CVE-2022-22473. CVE-2021-38951)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*
  • AND
  • cpe:/o:ibm:z/os:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:-:*:*:*:*:*:*:*
  • OR cpe:/o:linux:linux_kernel:-:*:*:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:-:*:*:*:*:*:*:*
  • OR cpe:/o:ibm:aix:-:*:*:*:*:*:*:*
  • OR cpe:/o:ibm:i:-:*:*:*:*:*:*:*
  • OR cpe:/o:oracle:solaris:-:*:*:*:*:*:-:*

    • Configuration CCN 1:
  • cpe:/a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:tivoli_monitoring:6.3.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:infosphere_master_data_management:11.6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_directory_server:6.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_identity_manager_virtual_appliance:7.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_identity_manager_virtual_appliance:7.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_verify_governance:10.0.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    ibm websphere application server 9.0
    ibm websphere application server 7.0
    ibm websphere application server 8.0
    ibm websphere application server 8.5
    ibm z/os -
    microsoft windows -
    linux linux kernel -
    hp hp-ux -
    ibm aix -
    ibm i -
    oracle solaris -
    ibm websphere application server 7.0
    ibm websphere application server 8.0
    ibm websphere application server 8.5
    ibm websphere application server 9.0
    ibm tivoli monitoring 6.3.0.7
    ibm infosphere master data management 11.6
    ibm security directory server 6.4.0
    ibm security identity manager virtual appliance 7.0.2
    ibm security identity manager virtual appliance 7.0.1
    ibm security verify governance 10.0.1