Skip to main content

Websphere Application Server Liberty CVE-2023-46158

CRITICAL
Insufficient Session Expiration (CWE-613)
2023-10-25 psirt@us.ibm.com
Information Disclosure IBM Websphere Application Server Liberty
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Oct 25, 2023 - 18:17 nvd
CRITICAL 9.8

DescriptionNVD

IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling. IBM X-Force ID: 268775.

AnalysisAI

IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-613. IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling. IBM X-Force ID: 268775. Affected products include: Ibm Websphere Application Server Liberty. Version information: through 23.0.0.10.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Websphere Application Server Liberty

View all
CVE-2026-8400 CRITICAL
9.8 Aug 05

Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Libe
CVE-2026-11541 CRITICAL
9.8 Jun 30

HTTP request smuggling in IBM WebSphere Application Server (traditional 8.5 and 9.0) and WebSphere Liberty (17.0.0.3 thr
CVE-2026-14529 CRITICAL
9.8 Jul 29

Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Serv
CVE-2026-14976 CRITICAL
9.8 Jul 28

Remote code execution in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8) allows unauthenti
CVE-2026-14525 CRITICAL
9.4 Aug 13

Authentication bypass in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8) allows remote att
CVE-2026-8646 CRITICAL
9.1 Jun 22

HTTP request smuggling in IBM WebSphere Application Server 8.5/9.0 and WebSphere Application Server Liberty 17.0.0.3 thr
CVE-2026-14980 HIGH
8.8 Jul 30

Cross-site request forgery in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables server-side r
CVE-2026-15064 HIGH
8.7 Jul 28

HTTP response smuggling in IBM WebSphere Application Server 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.7 all
CVE-2026-15325 HIGH
8.7 Jul 28

HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7 allows remote
CVE-2026-18499 HIGH
8.1 Aug 12

Privilege escalation in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 allows an authenticated low
CVE-2026-15328 HIGH
8.1 Jul 28

HTTP request smuggling in IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liber
CVE-2026-15280 HIGH
7.5 Jul 28

Information disclosure in IBM WebSphere Liberty ND Collective Controller, versions 17.0.0.3 through 26.0.0.8, allows rem

Same weakness CWE-613 – Insufficient Session Expiration

View all
CVE-2022-36179 CRITICAL POC
9.8
CVE-2026-26342 CRITICAL POC
9.8
CVE-2016-5069 CRITICAL POC
9.8
CVE-2024-29401 CRITICAL POC
9.8
CVE-2023-49091 CRITICAL POC
9.8
CVE-2023-5865 CRITICAL POC
9.8
CVE-2023-5838 CRITICAL POC
9.8
CVE-2023-1854 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2023-46158 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy