IBM WebSphere Application Server CVE-2012-4853 Cross-Site Request Forgery Vulnerability

Bugtraq ID:	56458
Class:	Design Error
CVE:	CVE-2012-4853
Remote:	Yes
Local:	No
Published:	Nov 07 2012 12:00AM
Updated:	Jan 23 2013 07:10AM
Credit:	IBM
Vulnerable:	IBM WebSphere Application Server for z/OS 7.0 IBM WebSphere Application Server for z/OS 6.0 IBM Websphere Application Server for IBM i 6.1 IBM Websphere Application Server for IBM i 7.0 IBM Websphere Application Server 8.0.0.0 IBM Websphere Application Server 8.0 IBM Websphere Application Server 7.0 IBM Websphere Application Server 6.1
Not Vulnerable:

IBM WebSphere Application Server CVE-2012-4853 Cross-Site Request Forgery Vulnerability

IBM WebSphere Application Server is prone to a cross-site request forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user and gain access to the affected application; other attacks are also possible.

IBM WebSphere Application Server versions prior to 8.5.0.1 are vulnerable; other versions may also be affected.

IBM WebSphere Application Server CVE-2012-4853 Cross-Site Request Forgery Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to visit a malicious Web page.

IBM WebSphere Application Server CVE-2012-4853 Cross-Site Request Forgery Vulnerability

Solution:
Vendor fixes are available. Please see the references for more information.

IBM WebSphere Application Server CVE-2012-4853 Cross-Site Request Forgery Vulnerability

References:

• IBM Websphere Homepage (IBM)