IBM Security Bulletin: Bypass security restrictions in WebSphere Application Server (CVE-2016-0385)
There is a potential bypass security restriction vulnerability in IBM WebSphere Application Server. This will only occur in environments that have the webcontainer custom property HttpSessionIdReuse enabled.
CVE(s): CVE-2016-0385
Affected product(s) and affected version(s):
This vulnerability affects the following versions and releases of IBM WebSphere Application Server
- Liberty
- Version 9.0
- Version 8.5.5
- Version 8.5
- Version 8.0
- Version 7.0
Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/2bykQTe
X-Force Database: http://ift.tt/2bH5iQp
from IBM Product Security Incident Response Team http://ift.tt/2byllN4