Vulnerability in IBM Websphere Application Server

CVE-2014-3070

The addFileRegistryAccount Virtual Member Manager (VMM) SPI Admin Task in IBM WebSphere Application Server (WAS) 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3 does not properly create accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors.

EPSS: 0.021 (80.2th percentile) — read the EPSS interpretation.

Affected products

Ibm Websphere_application_server — versions 8.5.0.0, 8.5.0.1, 8.5.0.2
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

psirt@us.ibm.com (vdb-entry, x_refsource_XF)
psirt@us.ibm.com (vdb-entry, x_refsource_BID)
psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
psirt@us.ibm.com (vendor-advisory, x_refsource_AIXAPAR)