PT-2010-1270 · Ibm · Ibm Websphere Commerce

Published 2010-02-05 · Updated 2017-08-17 · CVE-2009-2751

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce version 7.0

Description The issue is related to the use of the same cryptographic key for session attributes and merchant data encryption. This has an unspecified impact and can be exploited through remote attack vectors.

Recommendations For IBM WebSphere Commerce version 7.0, consider using distinct cryptographic keys for session attributes and merchant data encryption as a mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2009-2751

Affected Products

Ibm Websphere Commerce

References · 4

• http://www-1.ibm.com/support/docview.wss?uid=swg1JR35136 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21418443 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2751 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56089 · Note