PT-2009-3490 · Ibm · Ibm Websphere Application Server+2

Published 2009-06-03 · Updated 2018-11-08 · CVE-2009-0899

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1 through 6.1.0.24 IBM WebSphere Application Server versions 7.0 through 7.0.0.4 IBM WebSphere Portal Server versions 5.1 through 6.0 IBM Integrated Solutions Console version 6.0.1

Description The issue arises from the improper setting of the IsSecurityEnabled security flag during the migration of WebSphere Member Manager to Virtual Member Manager and a Federated Repository. This allows attackers to obtain sensitive information from repositories.

Recommendations For IBM WebSphere Application Server versions 6.1 through 6.1.0.24, update to a version that properly sets the IsSecurityEnabled flag. For IBM WebSphere Application Server versions 7.0 through 7.0.0.4, update to a version that properly sets the IsSecurityEnabled flag. For IBM WebSphere Portal Server versions 5.1 through 6.0, update to a version that properly sets the IsSecurityEnabled flag. For IBM Integrated Solutions Console version 6.0.1, update to a version that properly sets the IsSecurityEnabled flag.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-0899

Affected Products

Ibm Integrated Solutions Console

Ibm Websphere Application Server

Ibm Websphere Portal Server

References · 6

• http://www-01.ibm.com/support/docview.wss?uid=swg21375859 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1PK78134 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0899 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0899 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50882 · Note
• http://securityfocus.com/bid/35406 · Note