Vulnerability resource type
The vulnerability resource type describes a vulnerability that is detected in a server or runtime that is managed by WebSphere Automation.
Example vulnerability created event
{
"type" : "CREATE",
"vulnerability" : {
"created" : "2023-06-12T09:52:42Z",
"createdBy" : "server-registration-processor",
"description" : "There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server and IBM WebSphere Application Server Liberty. The CVE(s) listed in this document might affect some configurations of IBM WebSphere Application Server traditional and IBM WebSphere Application Server Liberty. These products have addressed the applicable CVE(s). If you run your own Java code using the IBM Java Runtime delivered with this product, you should evaluate your code to determine whether the complete list of vulnerabilities is applicable to your code. For a complete list of vulnerabilities, refer to the link for \"IBM Java SDK Security Bulletin\" located in the References section for more information. HP fixes are on a delayed schedule.",
"id" : "63d3b3f2-e49e-378b-a339-ac3753d48d33",
"name" : "6839565 : IBM J9 VM@defected1.example.com",
"updated" : "2023-06-12T09:52:42Z",
"updatedBy" : "server-registration-processor",
"assetId" : "f0842917-7c96-389e-b99f-302df459f944",
"cves" : [ {
"cvssBaseScore" : 5.3,
"description" : "An unspecified vulnerability in Java SE related to the Security component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.",
"id" : "CVE-2022-21626"
}, {
"cvssBaseScore" : 3.7,
"description" : "An unspecified vulnerability in Java SE related to the Security component could allow an unauthenticated attacker to update, insert or delete data resulting in a low integrity impact using unknown attack vectors.",
"id" : "CVE-2022-21624"
} ],
"remediations" : [ {
"additionalInstallationInstructions" : "https://www.ibm.com/support/pages/node/6839565",
"endVersion" : "8.0.7.19",
"fixPack" : "8.0.7.20",
"iFixes" : [ "PH50734" ],
"operator" : "OR",
"startVersion" : "8.0.0.0"
} ],
"resolved" : false,
"secondsExposed" : 0,
"securityBulletinId" : "f0a4388b-cbb5-3e46-a267-f230db98c073"
}
}Example vulnerability updated event
{
"type" : "UPDATE",
"vulnerability" : {
"created" : "2023-06-05T16:25:51Z",
"createdBy" : "vulnerability-manager",
"description" : "There is a vulnerability in the Apache CXF library used by IBM WebSphere Application Server Liberty with the jaxws-2.2 feature enabled. This has been addressed.",
"id" : "6f034f97-22e2-3b9e-8acd-7ab267d8da22",
"name" : "6953767 : test-server1@neoteric1.example.com",
"updated" : "2023-06-12T10:00:36Z",
"updatedBy" : "server-registration-processor",
"assetId" : "6879e6e1-7701-325f-9e4d-f55a7387480e",
"cves" : [ {
"cvssBaseScore" : 9.8,
"description" : "Apache CXF is vulnerable to server-side request forgery, caused by a flaw in parsing the href attribute of XOP:Include in MTOM requests. By using a specially-crafted request, an attacker could exploit this vulnerability to conduct SSRF attack.",
"id" : "CVE-2022-46364"
} ],
"remediations" : [ {
"endVersion" : "21.0.0.12",
"fixPack" : "23.0.0.2",
"iFixes" : [ "PH52095" ],
"operator" : "OR",
"startVersion" : "21.0.0.1"
} ],
"resolutionDate" : "2023-06-12T10:00:36Z",
"resolutionReason" : "feature-removed",
"resolved" : true,
"secondsExposed" : 581685,
"securityBulletinId" : "59bbdab3-bd2f-3c96-b1a6-64657859d9ec"
},
"originalVersion" : {
"created" : "2023-06-05T16:25:51Z",
"createdBy" : "vulnerability-manager",
"description" : "There is a vulnerability in the Apache CXF library used by IBM WebSphere Application Server Liberty with the jaxws-2.2 feature enabled. This has been addressed.",
"id" : "6f034f97-22e2-3b9e-8acd-7ab267d8da22",
"name" : "6953767 : test-server1@neoteric1.example.com",
"updated" : "2023-06-05T16:25:51Z",
"updatedBy" : "vulnerability-manager",
"assetId" : "6879e6e1-7701-325f-9e4d-f55a7387480e",
"cves" : [ {
"cvssBaseScore" : 9.8,
"description" : "Apache CXF is vulnerable to server-side request forgery, caused by a flaw in parsing the href attribute of XOP:Include in MTOM requests. By using a specially-crafted request, an attacker could exploit this vulnerability to conduct SSRF attack.",
"id" : "CVE-2022-46364"
} ],
"remediations" : [ {
"endVersion" : "21.0.0.12",
"fixPack" : "23.0.0.2",
"iFixes" : [ "PH52095" ],
"operator" : "OR",
"startVersion" : "21.0.0.1"
} ],
"resolved" : false,
"secondsExposed" : 581684,
"securityBulletinId" : "59bbdab3-bd2f-3c96-b1a6-64657859d9ec"
}
}Example vulnerability deleted event
{
"type" : "DELETE",
"vulnerability" : {
"created" : "2023-06-05T16:25:51Z",
"createdBy" : "vulnerability-manager",
"description" : "There is a vulnerability in the Apache Commons FileUpload library used by IBM WebSphere Application Server and used by IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0 or servlet-6.0 feature enabled. This has been addressed in the remediation section.",
"id" : "badcb19f-a493-3cf5-a748-36564daa94cf",
"name" : "6982047 : test-server1@neoteric1.example.com",
"updated" : "2023-06-05T16:25:51Z",
"updatedBy" : "vulnerability-manager",
"assetId" : "6879e6e1-7701-325f-9e4d-f55a7387480e",
"cves" : [ {
"cvssBaseScore" : 7.5,
"description" : "Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of request parts to be processed in the file upload function. By sending a specially-crafted request with series of uploads, a remote attacker could exploit this vulnerability to cause a denial of service condition.",
"id" : "CVE-2023-24998"
} ],
"remediations" : [ {
"endVersion" : "21.0.0.12",
"fixPack" : "23.0.0.4",
"iFixes" : [ "PH50863" ],
"operator" : "OR",
"startVersion" : "21.0.0.1"
} ],
"resolved" : false,
"secondsExposed" : 582285,
"securityBulletinId" : "7e38c015-dd84-351a-8084-47eeda5fc3e4"
}
}