CVE-2016-0378

Vulnerability

IBM WebSphere Application Server Liberty versions prior to 16.0.0.3 are affected by an information disclosure vulnerability. When the installation lacks a default error page, an exception triggered by a remote request is not properly handled, causing the server to disclose sensitive information in the error response. [1]

Exploitation

An attacker can send a crafted request that triggers an exception on the server. No authentication is required, but the attack complexity is high (CVSS:3.0/AV:N/AC:H). The attacker must know or guess a request that causes an exception, and the server must not have a custom error page defined. The exception details are then returned in the HTTP response. [1]

Impact

Successful exploitation leads to information disclosure (confidentiality impact low). The attacker may obtain sensitive data such as stack traces, internal paths, or configuration details that could aid further attacks. No impact on integrity or availability. [1]

Mitigation

IBM released Liberty Fix Pack 16.0.0.3 (or later) which includes the fix for APAR PI54459. Alternatively, apply Interim Fix PI54459. As a workaround, administrators can create a custom error page to prevent the default exception handling. [1]