CVE-2023-38737: IBM WebSphere Application Server Liberty denial of service
Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity (XXE) declarations by the XmlParser. By sending a specially crafted request, an attacker could exploit this vulnerability to conduct SSRF attack or cause a denial of service condition.
Other sources
IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 262567.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-38737.
What is the severity level of CVE-2023-38737?
The severity level of CVE-2023-38737 is high (7.5).
How does CVE-2023-38737 impact IBM WebSphere Application Server Liberty?
CVE-2023-38737 can cause denial of service by consuming memory resources on IBM WebSphere Application Server Liberty versions 22.0.0.13 through 23.0.0.7.
How can this vulnerability be exploited?
This vulnerability can be exploited by sending a specially-crafted request.
Is there a fix available for CVE-2023-38737?
Yes, IBM has provided a fix for CVE-2023-38737. Please refer to the IBM support page for more information.