PI06341: The WebSphere eXtreme Scale Client might allow the cached HTTP session data of one user to be accessed by a different user.

APAR status

• Closed as program error.

Error description

• In certain configurations, a security vulnerability exists in
  WebSphere eXtreme Scale Client, the client that is used with
  WebSphere eXtreme Scale and WebSphere DataPower XC10
  Appliance. WebSphere eXtreme Scale Client might allow cached
  HTTP session data of one user to be accessed by a different
  user when both users access the same web container.
  

Local fix

• Disabling the caching by any other servers which are  infront
  of XS server.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  Users of WebSphere eXtreme Scale Client     *
  *                  with WebSphere eXtreme Scale HTTP session   *
  *                  management.                                 *
  ****************************************************************
  * PROBLEM DESCRIPTION: The WebSphere eXtreme Scale Client      *
  *                      might allow the cached HTTP session     *
  *                      data of one user to be accessed by a    *
  *                      different user.                         *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  In certain configurations, a security vulnerability exists in
  WebSphere eXtreme Scale Client, the client that is used with
  WebSphere eXtreme Scale and WebSphere DataPower XC10
  Appliance. WebSphere eXtreme Scale Client might allow cached
  HTTP session data of one user to be accessed by a different
  user when both users access the same web container.
  

Problem conclusion

• A program change has been made to fix the problem. See
  http://www-01.ibm.com/support/docview.wss?uid=swg21664641 for
  information about the problem and about how to get the fix.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  PI09665 PI09901 PI09902

Fix information

• Fixed component name

  WS EXTREME SCAL

• Fixed component ID

  5724X6702

Applicable component levels

• R711 PSY

     UP

• R850 PSY

     UP

• R860 PSY

     UP