CVE-2021-39038 — UI Misrepresentation / Clickjacking in IBM Websphere Application Server

CWE-1021 — UI Misrepresentation / Clickjacking3 documents3 sources
Severity
5.4MEDIUMNVD
EPSS
0.0%
top 90.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Websphere Application ServerIBM Websphere Application Server Liberty
Timeline
PublishedFeb 24
Latest updateFeb 25

Description

IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 213968.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5ibm/websphere_application_server_liberty17.0.0.3, 22.0.0.2+1
▶NVDibm/websphere_application_server9.0.0.0 — 9.0.5.12+1

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-8f9v-jw34-v9r4: IBM WebSphere Application Server 9↗2022-02-25
▶
CVEList
CVE-2021-39038: IBM WebSphere Application Server 9↗2022-02-24
▶
CVE-2021-39038 — UI Misrepresentation / Clickjacking | cvebase