High severity7.5NVD Advisory· Published Jul 7, 2016· Updated Jun 17, 2026
CVE-2016-2923
CVE-2016-2923
Description
IBM WebSphere Application Server (WAS) 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified JAX-RS API cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
11cpe:2.3:a:ibm:websphere_application_server:8.5.5.0:*:*:*:liberty:*:*:*+ 10 more
- cpe:2.3:a:ibm:websphere_application_server:8.5.5.0:*:*:*:liberty:*:*:*
- cpe:2.3:a:ibm:websphere_application_server:8.5.5.1:*:*:*:liberty:*:*:*
- cpe:2.3:a:ibm:websphere_application_server:8.5.5.2:*:*:*:liberty:*:*:*
- cpe:2.3:a:ibm:websphere_application_server:8.5.5.3:*:*:*:liberty:*:*:*
- cpe:2.3:a:ibm:websphere_application_server:8.5.5.4:*:*:*:liberty:*:*:*
- cpe:2.3:a:ibm:websphere_application_server:8.5.5.5:*:*:*:liberty:*:*:*
- cpe:2.3:a:ibm:websphere_application_server:8.5.5.6:*:*:*:liberty:*:*:*
- cpe:2.3:a:ibm:websphere_application_server:8.5.5.7:*:*:*:liberty:*:*:*
- cpe:2.3:a:ibm:websphere_application_server:8.5.5.8:*:*:*:liberty:*:*:*
- cpe:2.3:a:ibm:websphere_application_server:8.5.5.9:*:*:*:liberty:*:*:*
- (no CPE)range: <=8.5.5.9
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.