CVE-2022-39161

Published: May 3, 2023Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.6 / Impact: 3.6

Source: NVD

Description

IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server, could allow an authenticated user to conduct spoofing attacks. A man-in-the-middle attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 235069.

Affected (5)

Products: Ibm: Websphere Application Server

Ibm

1 product

Websphere Application Server

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Ibm Websphere Application Server	All versions
Ibm Websphere Application Server	Version 7.0
Ibm Websphere Application Server	Version 8.0
Ibm Websphere Application Server	Version 8.5
Ibm Websphere Application Server	Version 9.0

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (4)

https://exchange.xforce.ibmcloud.com/vulnerabilities/235069

Source: psirt@us.ibm.com

VDB EntryVendor Advisory

https://www.ibm.com/support/pages/node/6987779

Source: psirt@us.ibm.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/235069

Source: af854a3a-2127-422b-91ae-364da2661108

VDB EntryVendor Advisory

https://www.ibm.com/support/pages/node/6987779

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.