PT-2011-3051 · Ibm · Ibm Websphere Application Server+1

Publicado 2011-03-08 · Atualizado 2011-03-29 · CVE-2011-1320

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1.0.x through 6.1.0.34 IBM WebSphere Application Server versions 7.x through 7.0.0.14

Description The issue arises when the Tivoli Integrated Portal / embedded WebSphere Application Server framework is used, and the Security component does not properly delete AuthCache entries upon a logout. This might allow remote attackers to access the server by leveraging an unattended workstation.

Recommendations For IBM WebSphere Application Server versions 6.1.0.x through 6.1.0.34, update to version 6.1.0.35 or later. For IBM WebSphere Application Server versions 7.x through 7.0.0.14, update to version 7.0.0.15 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-1320

Produtos afetados

Ibm Websphere Application Server

Ibm Tivoli Integrated Portal

Referências · 4

• http://www-01.ibm.com/support/docview.wss?uid=swg1PM21536 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg27014463 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1320 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1320 · Nota