XLinkedIn
1 973-826-7406|info@AvadaSoftware.com

Security Bulletin: IBM WebSphere Application Server is vulnerable to remote code execution due to Dojo (CVE-2021-23450)

Security Bulletin: IBM WebSphere Application Server is vulnerable to remote code execution due to Dojo (CVE-2021-23450)

There is a vulnerability in the Dojo library used by IBM WebSphere Application Server traditional in the Admin Console and used by the IBM WebSphere Application Server Liberty with the adminCenter-1.0 feature enabled that allows arbitrary code to be executed in the browser. This has been addressed.

Vulnerability Details

CVEID: CVE-2021-23450

DESCRIPTION: Dojo could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution in the setObject function. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/216463 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the APAR PH43148 or APAR PH43817. To determine if a feature is enabled for WebSphere Application Server Liberty, refer to How to determine if Liberty is using a specific feature.

[…]

Click here to view original web page at www.ibm.com

By |2022-03-16T15:51:08-04:00March 16th, 2022|Infrared360® Blog, IT Infrastructure, Middleware, WebSphere Application Server|

About the Author:

Related Posts

Simplifying Message Filtering and Selection for Accurate Test Scenarios with Infrared360
Simplifying Message Filtering and Selection for Accurate Test Scenarios with Infrared360
Gallery

Simplifying Message Filtering and Selection for Accurate Test Scenarios with Infrared360

Critical ReDoS and SSRF ACE Vulnerabilities Addressed
Critical ReDoS and SSRF ACE Vulnerabilities Addressed
Gallery

Critical ReDoS and SSRF ACE Vulnerabilities Addressed

Webinar: Maximize the value of your data by integrating IBM MQ and IBM Event Automation
Webinar: Maximize the value of your data by integrating IBM MQ and IBM Event Automation
Gallery

Webinar: Maximize the value of your data by integrating IBM MQ and IBM Event Automation

Addressing Two IBM App Connect Enterprise Vulnerabilities
Addressing Two IBM App Connect Enterprise Vulnerabilities
Gallery

Addressing Two IBM App Connect Enterprise Vulnerabilities

How the IBM MQ Kafka Connector Works
How the IBM MQ Kafka Connector Works
Gallery

How the IBM MQ Kafka Connector Works

AVADA SOFTWARE AT A GLANCE

Avada Software’s flagship product, Infrared360®, is an IT management portal providing total administration, monitoring, testing, auditing, analytics dashboards, and self-service for cloud, on-prem, or hybrid environments. Get secure, collaborative management of elements across your IT stack like Kafka®, IBM® MQ, IBM® ACE/IIB, ActiveMQ®, WebSphere®, JBoss®, and Tomcat® Application Servers, URLs, SOAP & REST-based web services, IBM® DataPower® and MQ Appliance.

Latest Insight

The Middleware Blog

March 21st, 2024|

IBM TechCon 2024 Session Recap: “IBM MQ and Event Automation – Better Together”

IBM® MQ is a robust messaging solution known for its reliability, while IBM Event Automation simplifies the creation of event-driven applications. In their IBM TechCon 2024 session, David Ware, CTO of IBM MQ and Event Automation, IBM and Matt Sunley, Program Director for Event Automation, IBM explained how integrating these technologies benefits businesses. They gain […]

Read More

March 20th, 2024|

IBM TechCon 2024 Session Recap: IBM MQ and Event Automation – What’s New and Trends

This recap dives into the latest advancements in IBM MQ and Event Automation, unveiled at IBM TechCon 2024.

IBM MQ: Still a Powerful Messaging Foundation

The session kicked off with David Ware showcasing how IBM MQ, despite the rise of real-time data, remains a critical foundation for businesses. David […]

Read More

March 15th, 2024|

Table of Contents

Middleware Observability vs. General IT Observability – Understanding the Nuances 

What’s the difference between Middleware observability and other IT observability?

IT operations and site reliability engineering (SRE) teams use infrastructure observability tools like Datadog and SolarWinds to understand the current state of their infrastructure, and the applications that run on them, at all times. For most companies, this means servers, […]

Read More

March 5th, 2024|

The Crucial Role of Synthetic Transactions in Testing IBM® MQ Environments

Messaging systems form the backbone of many modern enterprises, and IBM MQ is a leader in this space. However, ensuring these complex message environments are robust and reliable takes more than just hoping for the best. Synthetic transactions, by simulating real-world user interactions, provide a proactive way to test IBM MQ’s performance, resilience, and overall health.

Read More

February 12th, 2024|

Alert Fatigue: A Guide for IT Administrators (and How to Solve It)

In the always-on world of IT operations, alert fatigue undermines the effectiveness of monitoring systems and those who manage them. This guide explores the causes and consequences of alert fatigue, outlining its toll on user responsiveness, system stability, and increased workload for IT administrators.

We’ll provide practical strategies to regain control, ensuring efficient incident response and […]

Read More

January 31st, 2024|

Navigating MQ: From Basics to Best Practices

A Step-by-Step Guide on how to Clear the IBM® MQ Dead Letter Queue

Managing the dead letter queue (DLQ) within IBM MQ demands a meticulous and strategic approach. The DLQ acts as a repository for messages that failed to be delivered or processed successfully, offering a critical avenue for troubleshooting and resolution. To manage it effectively, a structured process […]

Read More

We are proud supporters of:

Avada Software. All Rights Reserved |This website may contain logos and trademarks of third parties. These are the property of their respective owners and are used on this site for informational purposes only. Avada Software does not claim any ownership or association with these trademarks or, except where explicitly stated, their respective organizations. | Privacy Policy
Go to Top