Some vulnerabilities have been reported in IBM WebSphere Application Server for z/OS, which can be exploited by malicious people to potentially disclose sensitive information, conduct cross-site request forgery attacks, or cause a DoS (Denial of Service).

1) Some vulnerabilities in APR-util can be exploited by malicious users and malicious people to disclose potentially sensitive information or cause a DoS (Denial of Service).

2) An unspecified error in the "Apr_xml_*" interface can be exploited to cause a DoS.

3) The administrative console allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform normally restricted actions if a logged-in user visits a malicious web site.

4) An error in the included web server can be exploited to e.g. cause a high CPU load via specially crafted HTTP requests.


The vulnerabilities are reported in WebSphere Application Server version 7.0 for z/OS. Other versions may also be affected.

Apply APARs PK99478, PK99477, and PK99480.