IBM WebSphere Application Server Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in IBM WebSphere Application Server versions 8.5 and 9.0. This vulnerability allows authenticated attackers to send unauthorized requests from the server, which could lead to network enumeration or facilitate other types of attacks.

Impact

Exploitation of this vulnerability could allow an authenticated attacker to send unauthorized requests from the server, potentially leading to network enumeration or other attacks.

Remediation

Users are advised to upgrade to the latest fix pack that includes the fix for APAR PH65941. For WebSphere Application Server 9.0, apply Fix Pack 9.0.5.24 or later. For WebSphere Application Server 8.5, apply Fix Pack 8.5.5.28 or later. Additional interim fixes may be available.