PT-2013-2402 · Ibm · Ibm Websphere Commerce Enterprise

Published 2013-06-21 · Updated 2019-09-30 · CVE-2013-0523

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce Enterprise versions 5.6.x through 5.6.1.5 IBM WebSphere Commerce Enterprise versions 6.0.x through 6.0.0.11 IBM WebSphere Commerce Enterprise versions 7.0.x through 7.0.0.7

Description The issue allows remote attackers to obtain sensitive information via a padding oracle attack that targets certain UTF-8 processing of the krypto parameter. This attack can leverage unspecified browser access or traffic-log access.

Recommendations For versions 5.6.x through 5.6.1.5, update to a version that uses a suitable encryption algorithm for storefront web requests. For versions 6.0.x through 6.0.0.11, update to a version that uses a suitable encryption algorithm for storefront web requests. For versions 7.0.x through 7.0.0.7, update to a version that uses a suitable encryption algorithm for storefront web requests.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-0523

Affected Products

Ibm Websphere Commerce Enterprise

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-0523 · Security Note
• https://www-01.ibm.com/support/docview.wss?uid=swg21640597 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1JR46386 · Vendor Advisory
• http://vsecurity.com/advisory/20130619-1.txt · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82541 · Note
• http://vsecurity.com/resources/advisory/20130619-1 · Note