IBM WebSphere Application Server versions 8.5 and 9.0 contain a vulnerability classified as CWE-117 (Improper Output Neutralization for Logs). This flaw allows a remote attacker to inject forged log entries into the administrative log of the server. The vulnerability has a CVSS 3.1 base score of 4.8, indicating medium severity, with an attack vector of network, high attack complexity, no privileges required, and no user interaction needed. The impact affects confidentiality and integrity at a low level, with no impact on availability. No known exploits are reported in the wild, and no official patch or remediation information is provided in the data.

The vulnerability allows remote attackers to inject forged entries into administrative logs, potentially misleading administrators or forensic investigators by corrupting log integrity. The confidentiality and integrity impacts are low, and availability is not affected. This could hinder incident response or auditing processes but does not directly compromise system control or data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, administrators should monitor IBM's advisories for updates. Until a fix is available, consider restricting network access to the administrative interfaces and reviewing logging configurations to detect anomalous entries.