7.5

CVE-2009-0903

IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3, and the Feature Pack for Web Services for WAS 6.1 before 6.1.0.25, when a WS-Security policy is established at the operation level, does not properly handle inbound requests that lack a SOAPAction or WS-Addressing Action, which allows remote attackers to bypass intended access restrictions via a crafted request to a JAX-WS application.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Websphere Application Server Version 6.1.0
Ibm ≫ Websphere Application Server Version 6.1.0.0
Ibm ≫ Websphere Application Server Version 6.1.0.1
Ibm ≫ Websphere Application Server Version 6.1.0.2
Ibm ≫ Websphere Application Server Version 6.1.0.3
Ibm ≫ Websphere Application Server Version 6.1.0.4
Ibm ≫ Websphere Application Server Version 6.1.0.5
Ibm ≫ Websphere Application Server Version 6.1.0.6
Ibm ≫ Websphere Application Server Version 6.1.0.7
Ibm ≫ Websphere Application Server Version 6.1.0.8
Ibm ≫ Websphere Application Server Version 6.1.0.9
Ibm ≫ Websphere Application Server Version 6.1.0.10
Ibm ≫ Websphere Application Server Version 6.1.0.11
Ibm ≫ Websphere Application Server Version 6.1.0.12
Ibm ≫ Websphere Application Server Version 6.1.0.13
Ibm ≫ Websphere Application Server Version 6.1.0.14
Ibm ≫ Websphere Application Server Version 6.1.0.15
Ibm ≫ Websphere Application Server Version 6.1.0.16
Ibm ≫ Websphere Application Server Version 6.1.0.17
Ibm ≫ Websphere Application Server Version 6.1.0.18
Ibm ≫ Websphere Application Server Version 6.1.0.19
Ibm ≫ Websphere Application Server Version 6.1.0.20
Ibm ≫ Websphere Application Server Version 6.1.0.21
Ibm ≫ Websphere Application Server Version 6.1.0.22
Ibm ≫ Websphere Application Server Version 6.1.0.23
Ibm ≫ Websphere Application Server Version 6.1.0.24
Ibm ≫ Websphere Application Server Version 7.0.0.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.16% 0.798
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www-1.ibm.com/support/docview.wss?uid=swg1PK72138
http://www-1.ibm.com/support/docview.wss?uid=swg1PK81944
Patch
Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1PK87767
Patch
Vendor Advisory
http://www.securityfocus.com/bid/35594
https://exchange.xforce.ibmcloud.com/vulnerabilities/51293