IBM AppScan Multiple High-Severity Vulnerabilities (CVE-2021-43875 etc.) and Remediation

Critical Vulnerability Information Vulnerability Overview CVE IDs: CVE-2021-43875, CVE-2021-43897, CVE-2021-43940, CVE-2021-43961, CVE-2021-43973, CVE-2021-43980, CVE-2021-43985, CVE-2021-43988 Affected Products and Versions: IBM Appscan 2.0.0 - 2.0.1, Fixpack 0 - 0.0.1.1 Remediation Recommendation: Upgrade to Fixpack 5.0.1.0, available from IBM Fix Central. Vulnerability Details CVE-2021-43875: NVD-CVE-2021-43875 describes an improper Internal Message Access Control (IMAC) configuration in AppScan Enterprise, which could allow unauthorized users to perform arbitrary operations via Tracery. CVE-2021-43897: Describes a security vulnerability in Selenium WebDriver that allows attackers to inject malicious code via specific HTTP requests. CVE-2021-43940: Describes a remote code execution vulnerability in Apache Tomcat, where attackers can execute arbitrary code by sending specially crafted HTTP requests. CVE-2021-43961: Describes a remote code execution vulnerability in the Spring Framework, exploitable via specially crafted HTTP requests. CVE-2021-43973: Describes a remote code execution vulnerability in Apache Struts2, exploitable via specially crafted HTTP requests. CVE-2021-43980: Describes a remote code execution vulnerability in Apache Log4j, exploitable via specially crafted log entries. CVE-2021-43985: Describes a remote code execution vulnerability in Apache HttpClient, exploitable via specially crafted HTTP requests. CVE-2021-43988: Describes a deserialization vulnerability in Apache Commons Collections, exploitable via specially crafted serialized data. Affected Products and Versions Appscan: 2.0.0 - 2.0.1 Fixpack: 0 - 0.0.1.1 Remediation Measures Upgrade Recommendation: IBM strongly recommends upgrading to Fixpack 5.0.1.0 to address these vulnerabilities, which is available from IBM Fix Central. Workarounds and Mitigations No specific workarounds or mitigations are provided; it is recommended to upgrade directly to the latest version to ensure security.

Goal Reached Thanks to every supporter — we hit 100%!

IBM AppScan Multiple High-Severity Vulnerabilities (CVE-2021-43875 etc.) and Remediation