PT-2009-3490 · Ibm · Ibm Websphere Application Server+2

Publicado 2009-06-03 · Atualizado 2018-11-08 · CVE-2009-0899

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1 through 6.1.0.24 IBM WebSphere Application Server versions 7.0 through 7.0.0.4 IBM WebSphere Portal Server versions 5.1 through 6.0 IBM Integrated Solutions Console version 6.0.1

Description The issue arises from the improper setting of the IsSecurityEnabled security flag during the migration of WebSphere Member Manager to Virtual Member Manager and a Federated Repository. This allows attackers to obtain sensitive information from repositories.

Recommendations For IBM WebSphere Application Server versions 6.1 through 6.1.0.24, update to a version that properly sets the IsSecurityEnabled flag. For IBM WebSphere Application Server versions 7.0 through 7.0.0.4, update to a version that properly sets the IsSecurityEnabled flag. For IBM WebSphere Portal Server versions 5.1 through 6.0, update to a version that properly sets the IsSecurityEnabled flag. For IBM Integrated Solutions Console version 6.0.1, update to a version that properly sets the IsSecurityEnabled flag.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-0899

Produtos afetados

Ibm Integrated Solutions Console

Ibm Websphere Application Server

Ibm Websphere Portal Server

Referências · 6

• http://www-01.ibm.com/support/docview.wss?uid=swg21375859 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0899 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50882 · Nota
• http://www-1.ibm.com/support/docview.wss?uid=swg1PK78134 · Aviso do Fabricante
• http://securityfocus.com/bid/35406 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0899 · Nota de Segurança