IBM WebSphere Application Server Liberty Weaker Than Expected Security Vulnerability

A vulnerability exists in IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.3, which could lead to weaker than expected security when managing security settings. This issue is particularly relevant when the appSecurity features (versions 1.0 through 5.0) are enabled.

Impact

Exploitation of this vulnerability could result in security settings being administered in a manner that undermines their intended strength, potentially leading to unauthorized access or actions within the application.

Remediation

Users are advised to upgrade to IBM WebSphere Application Server Liberty Fix Pack 26.0.0.4 or later, or to apply the interim fix for APAR PH70078 available for versions 17.0.0.3 through 26.0.0.3. After applying the interim fix or fix pack, follow the additional instructions provided to complete the remediation.