VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions 1 Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/8xxx/CVE-2026-8620.json
T

150 lines
8.3 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-8620",
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"state": "PUBLISHED",
"assignerShortName": "ibm",
"dateReserved": "2026-05-14T18:19:54.491Z",
"datePublished": "2026-05-26T17:15:00.501Z",
"dateUpdated": "2026-05-27T13:12:59.224Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm",
"dateUpdated": "2026-05-26T17:15:00.501Z"
},
"title": "IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-ins",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "IBM",
"product": "Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty",
"versions": [
{
"status": "affected",
"version": "8.5, 9.0",
"lessThanOrEqual": "Interim Fix 002",
"versionType": "semver"
}
],
"cpes": [
"cpe:2.3:a:ibm:web_server_plug_ins_for_websphere_application_server_and_websphere_liberty:8.5:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:web_server_plug_ins_for_websphere_application_server_and_websphere_liberty:8.5.0:*:*:*:*:*:*:*"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to HTTP request smuggling in the Web Server Plug-ins through a specially crafted request.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to HTTP request smuggling in the Web Server Plug-ins through a specially crafted request.</p>"
}
]
}
],
"references": [
{
"url": "https://www.ibm.com/support/pages/node/7274072",
"tags": [
"vendor-advisory",
"patch"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseSeverity": "HIGH",
"baseScore": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N"
}
}
],
"solutions": [
{
"lang": "en",
"value": "IBM strongly recommends addressing the vulnerability now by applying a currently available Web Server Plug-ins interim fix or fix pack that contains the fix for APAR PH71342. \n\n\n\n\n\n\n\nWeb Server Plug-ins for IBM WebSphere Application Server (used with either WebSphere Application Server traditional or Liberty):\n\n\n\nFor V9.0.0.0 through 9.0.5.27:\n· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Web Server Plug-ins Interim Fix that resolves  PH71342 https://www.ibm.com/support/pages/node/7273976 \n--OR--\n· Apply Web Server Plug-ins Fix Pack 9.0.5.28 or later (targeted availability 2Q2026).  \n\n\n\nFor V8.5.0.0 through 8.5.5.29:\n· Upgrade to minimal fix pack levels as required by interim fix and then apply Web Server Plug-ins Interim Fix that resolves  PH71342 https://www.ibm.com/support/pages/node/7273976 \n--OR--\n· Apply Web Server Plug-ins Fix Pack 8.5.5.30 or later (targeted availability 3Q2026).\n\n\n\n\n\n\n\nAdditional interim fixes may be available and linked off the interim fix download page.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>IBM strongly recommends addressing the vulnerability now by applying a currently available Web Server Plug-ins interim fix or fix pack that contains the fix for APAR PH71342.&nbsp;</p><p></p><p><strong>Web Server Plug-ins for IBM WebSphere Application Server</strong> (used with either WebSphere Application Server traditional or Liberty):</p><p><strong>For V9.0.0.0 through 9.0.5.27:</strong><br>· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Web Server Plug-ins Interim Fix that resolves&nbsp;<a href=\"https://www.ibm.com/support/pages/node/7273976\" rel=\"nofollow\">PH71342</a><br>--OR--<br>· Apply Web Server Plug-ins Fix Pack 9.0.5.28 or later (targeted availability 2Q2026).&nbsp;&nbsp;</p><p><strong>For V8.5.0.0 through 8.5.5.29:</strong><br>· Upgrade to minimal fix pack levels as required by interim fix and then apply Web Server Plug-ins Interim Fix that resolves&nbsp;<a href=\"https://www.ibm.com/support/pages/node/7273976\" rel=\"nofollow\">PH71342</a><br>--OR--<br>· Apply Web Server Plug-ins Fix Pack 8.5.5.30 or later (targeted availability 3Q2026).</p><p></p><p>Additional interim fixes may be available and linked off the interim fix download page.</p>"
}
]
}
],
"x_generator": {
"engine": "ibm-cvegen"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-05-27T13:12:49.669182Z",
"id": "CVE-2026-8620",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-05-27T13:12:59.224Z"
}
}
]
}
}
View Git Blame Copy Permalink