IBM WebSphere eXtreme Scale And DataPower XC10 Information Disclosure Vulnerability

Bugtraq ID:	65690
Class:	Design Error
CVE:	CVE-2013-6734
Remote:	Yes
Local:	No
Published:	Feb 14 2014 12:00AM
Updated:	Feb 14 2014 12:00AM
Credit:	IBM
Vulnerable:	IBM WebSphere eXtreme Scale 8.6 IBM WebSphere eXtreme Scale 8.5 IBM WebSphere eXtreme Scale 7.1.1 IBM WebSphere eXtreme Scale 7.1 IBM WebSphere DataPower XC10 Appliance 2.5 IBM WebSphere DataPower XC10 Appliance 2.1
Not Vulnerable:	IBM WebSphere eXtreme Scale 8.6 4 PI06341 IBM WebSphere eXtreme Scale 8.5 3 PI06341 IBM WebSphere eXtreme Scale 7.1.1 1 PI06341 IBM WebSphere eXtreme Scale 7.1 3PI09901 IBM WebSphere DataPower XC10 Appliance 2.5.0 PI06341 IBM WebSphere DataPower XC10 Appliance 2.1.0 PI06341

IBM WebSphere eXtreme Scale And DataPower XC10 Information Disclosure Vulnerability

IBM WebSphere eXtreme Scale and DataPower XC10 are prone to an unspecified information-disclosure vulnerability.

An attacker can exploit this issue to gain access to cached HTTP session data of other users. This may lead to further attacks.

The following versions are vulnerable:

WebSphere eXtreme Scale 7.1.0
WebSphere eXtreme Scale 7.1.1
WebSphere eXtreme Scale 8.5.0
WebSphere eXtreme Scale 8.6.0
WebSphere DataPower XC10 Appliance 2.1
WebSphere DataPower XC10 Appliance 2.5

IBM WebSphere eXtreme Scale And DataPower XC10 Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM WebSphere eXtreme Scale And DataPower XC10 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM WebSphere eXtreme Scale And DataPower XC10 Information Disclosure Vulnerability

References:

• IBM Homepage (IBM)
  
• Security Bulletin: WebSphere eXtreme Scale and WebSphere DataPower XC10 Applianc (IBM)