IBM WebSphere Application Server versions 8.5 and 9.0 contain a vulnerability classified as CWE-117 (Improper Output Neutralization for Logs) that permits remote attackers to inject forged log entries into the administrative log. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to integrity loss of log data without affecting confidentiality or availability.

The vulnerability allows attackers to inject false or misleading entries into administrative logs, potentially obscuring malicious activity or causing confusion during incident investigations. There is no impact on confidentiality or availability of the system.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the IBM advisory for current remediation guidance. Until a fix is available, monitor logs carefully for suspicious entries and consider restricting access to logging interfaces.