CVE-2024-25026

IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 281516.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/281516	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/7149330	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/281516	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/7149330	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:websphere_application_server:::::traditional:::*
	cpe:2.3:a:ibm:websphere_application_server:::::traditional:::*
	cpe:2.3:a:ibm:websphere_application_server:::::liberty:::*

History

27 Feb 2025, 16:24

Type	Values Removed	Values Added
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/281516 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/281516 - VDB Entry, Vendor Advisory
References	~~() https://www.ibm.com/support/pages/node/7149330 -~~	() https://www.ibm.com/support/pages/node/7149330 - Vendor Advisory
First Time		Ibm Ibm websphere Application Server
CPE		cpe:2.3:a:ibm:websphere_application_server:::::liberty:::* cpe:2.3:a:ibm:websphere_application_server:::::traditional:::*

Information

Published : 2024-04-25 13:15

Updated : 2025-02-27 16:24

NVD link : CVE-2024-25026

Mitre link : CVE-2024-25026

CVE.ORG link : CVE-2024-25026

JSON object : View

Products Affected

ibm

websphere_application_server

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2024-25026", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-04-25T13:15:51.403", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/281516", "tags": ["VDB Entry", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/7149330", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/281516", "tags": ["VDB Entry", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.ibm.com/support/pages/node/7149330", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 281516."}, {"lang": "es", "value": "IBM WebSphere Application Server 8.5, 9.0 e IBM WebSphere Application Server Liberty 17.0.0.3 a 24.0.0.4 son vulnerables a una denegaci\u00f3n de servicio provocada por el env\u00edo de una solicitud especialmente manipulada. Un atacante remoto podr\u00eda aprovechar esta vulnerabilidad para hacer que el servidor consuma recursos de memoria. ID de IBM X-Force: 281516."}], "lastModified": "2025-02-27T16:24:20.267", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:traditional:*:*:*", "vulnerable": true, "matchCriteriaId": "8677BF8C-9A36-4B25-B3CE-4BEF12C708E9", "versionEndIncluding": "8.5.5.25", "versionStartIncluding": "8.5.0.0"}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:traditional:*:*:*", "vulnerable": true, "matchCriteriaId": "AB81C4D9-202E-4014-A884-F89B6DA180F7", "versionEndIncluding": "9.0.5.19", "versionStartIncluding": "9.0.0.0"}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:liberty:*:*:*", "vulnerable": true, "matchCriteriaId": "809F24BB-0D3E-444C-A9E8-53C2AECA3B01", "versionEndIncluding": "24.0.0.4", "versionStartIncluding": "17.0.0.3"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}