PI09901: The WebSphere eXtreme Scale Client might allow the cached HTTP session data of one user to be accessed by a different user.

APAR status

• Closed as program error.

Error description

• In certain configurations, a security vulnerability exists in
  WebSphere eXtreme Scale Client, the client that is used with
  WebSphere eXtreme Scale and WebSphere DataPower XC10
  Appliance. WebSphere eXtreme Scale Client might allow cached
  HTTP session data of one user to be accessed by a different
  user when both users access the same web container.
  

Local fix

• Disabling the caching by any other servers which are  infront
  of XS server.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  Users who use the WebSphere eXtreme Scale   *
  *                  V7.1.0 client to access an HTTP session     *
  *                  cache.                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  *                      The WebSphere eXtreme Scale Client      *
  *                      might allow the cached HTTP session     *
  *                      data of one user to be accessed by a    *
  *                      different user.                         *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  In certain configurations, a security vulnerability exists in
  WebSphere eXtreme Scale Client, the client that is used with
  WebSphere eXtreme Scale and WebSphere DataPower XC10
  Appliance. WebSphere eXtreme Scale Client might allow cached
  HTTP session data of one user to be accessed by a different
  user when both users access the same web container.
  

Problem conclusion

• This is a program defect, and a fix is available.  See
  http://www-01.ibm.com/support/docview.wss?uid=swg21664641 for
  information about the problem and about how to get the fix.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PI06341

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  XD EXTREME SCAL

• Fixed component ID

  5724J3402

Applicable component levels

• R710 PSY

     UP