Vulnerability Details CVE-2009-0899
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.24 and 7.0 through 7.0.0.4, IBM WebSphere Portal Server 5.1 through 6.0, and IBM Integrated Solutions Console (ISC) 6.0.1 do not properly set the IsSecurityEnabled security flag during migration of WebSphere Member Manager (WMM) to Virtual Member Manager (VMM) and a Federated Repository, which allows attackers to obtain sensitive information from repositories via unspecified vectors.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 56.0%
CVSS Severity
CVSS v2 Score 4.3
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21375859
- http://www-1.ibm.com/support/docview.wss?uid=swg1PK78134
- http://www.securityfocus.com/bid/35406
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50882
- http://www-01.ibm.com/support/docview.wss?uid=swg21375859
- http://www-1.ibm.com/support/docview.wss?uid=swg1PK78134
- http://www.securityfocus.com/bid/35406
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50882
Products affected by CVE-2009-0899
-
cpe:2.3:a:ibm:integrated_solutions_console:6.0.1
-
cpe:2.3:a:ibm:websphere_application_server:6.1
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.0
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.1
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.11
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.12
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.13
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.14
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.15
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.17
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.19
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.2
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.21
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.23
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.24
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.3
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.5
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.7
-
cpe:2.3:a:ibm:websphere_application_server:6.1.0.9
-
cpe:2.3:a:ibm:websphere_application_server:7.0
-
cpe:2.3:a:ibm:websphere_application_server:7.0.0.0
-
cpe:2.3:a:ibm:websphere_application_server:7.0.0.1
-
cpe:2.3:a:ibm:websphere_application_server:7.0.0.2
-
cpe:2.3:a:ibm:websphere_application_server:7.0.0.3
-
cpe:2.3:a:ibm:websphere_application_server:7.0.0.4
-
cpe:2.3:a:ibm:websphere_portal:5.1
-
cpe:2.3:a:ibm:websphere_portal:6.0.0