IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 10/01/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| sterling b2b integrator | = 5.2 | |
| sterling integrator | = 5.1 | |
| tivoli common reporting | = 2.1= 2.1.1= 2.1.1.2= 3.1= 3.1.0.1= 3.1.0.2= 3.1.2= 3.1.2.1 | |
| watson content analytics | ≥ 3.0, ≤ 3.0.0.6≥ 3.5, ≤ 3.5.0.3 | |
| watson explorer analytical components | = 11.0≥ 10.0, ≤ 10.0.0.2 | |
| watson explorer annotation administration console | = 11.0≥ 10.0, ≤ 10.0.0.2 | |
| websphere application server | = 7.0.0.0= 8.0.0.0= 8.5= 8.5.0.0= 8.5.5.5 |
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free