IBM WebSphere Application Server Liberty JMS Security Bypass Vulnerability

A security bypass vulnerability has been identified in IBM WebSphere Application Server Liberty versions 17.0.0.3 prior to 25.0.0.8. This vulnerability allows remote attackers to bypass security restrictions due to the application not properly honoring JMS messaging configurations. The issue arises when the wasJmsServer-1.0, wasJmsSecurity-1.0, wasJmsClient-2.0, messagingServer-3.0, messagingSecurity-3.0, or messagingClient-3.0 features are enabled.

Impact

Exploitation of this vulnerability could lead to unauthorized access or actions being performed, bypassing intended security measures.

Remediation

Users are advised to upgrade to IBM WebSphere Application Server Liberty Fix Pack 25.0.0.9 or later, or to apply the interim fix for APAR PH67546. Instructions for applying this interim fix are available on the IBM Support page.