Lucene search

MitreCVE-2009-0506

HistoryFeb 25, 2009 - 4:30 p.m.

CVE-2009-0506

2009-02-2516:30:00

mitre

web.nvd.nist.gov

cve-2009-0506

ibm

websphere

application server

was

vulnerabilty

csiv2 identity assertion

ejb

z/os

CVSS2

6.2

Attack Vector

LOCAL

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:H/Au:N/C:C/I:C/A:C

AI Score

6.2

Confidence

Low

EPSS

Percentile

5.1%

JSON

Unspecified vulnerability in IBM WebSphere Application Server (WAS) 5.1 and 6.0.2 before 6.0.2.33 on z/OS, when CSIv2 Identity Assertion is enabled and Enterprise JavaBeans (EJB) interaction occurs between a WAS 6.1 instance and a WAS pre-6.1 instance, allows local users to have an unknown impact via vectors related to (1) use of the wrong subject and (2) multiple CBIND checks.

Affected configurations

Nvd

Node

ibmwebsphere_application_serverMatch5.1.0

ibmwebsphere_application_serverMatch6.0.2

ibmwebsphere_application_serverMatch6.0.2.4

ibmwebsphere_application_serverMatch6.0.2.6

ibmwebsphere_application_serverMatch6.0.2.8

ibmwebsphere_application_serverMatch6.0.2.10

ibmwebsphere_application_serverMatch6.0.2.12

ibmwebsphere_application_serverMatch6.0.2.14

ibmwebsphere_application_serverMatch6.0.2.16

ibmwebsphere_application_serverMatch6.0.2.18

ibmwebsphere_application_serverMatch6.0.2.20

ibmwebsphere_application_serverMatch6.0.2.22

ibmwebsphere_application_serverMatch6.0.2.24

AND

ibmz\/os

VendorProductVersionCPE
ibmwebsphere_application_server5.1.0cpe:2.3:a:ibm:websphere_application_server:5.1.0:*:*:*:*:*:*:*
ibmwebsphere_application_server6.0.2cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:*:*:*:*:*:*
ibmwebsphere_application_server6.0.2.4cpe:2.3:a:ibm:websphere_application_server:6.0.2.4:*:*:*:*:*:*:*
ibmwebsphere_application_server6.0.2.6cpe:2.3:a:ibm:websphere_application_server:6.0.2.6:*:*:*:*:*:*:*
ibmwebsphere_application_server6.0.2.8cpe:2.3:a:ibm:websphere_application_server:6.0.2.8:*:*:*:*:*:*:*
ibmwebsphere_application_server6.0.2.10cpe:2.3:a:ibm:websphere_application_server:6.0.2.10:*:*:*:*:*:*:*
ibmwebsphere_application_server6.0.2.12cpe:2.3:a:ibm:websphere_application_server:6.0.2.12:*:*:*:*:*:*:*
ibmwebsphere_application_server6.0.2.14cpe:2.3:a:ibm:websphere_application_server:6.0.2.14:*:*:*:*:*:*:*
ibmwebsphere_application_server6.0.2.16cpe:2.3:a:ibm:websphere_application_server:6.0.2.16:*:*:*:*:*:*:*
ibmwebsphere_application_server6.0.2.18cpe:2.3:a:ibm:websphere_application_server:6.0.2.18:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	websphere_application_server	5.1.0	cpe:2.3:a:ibm:websphere_application_server:5.1.0:::::::*
ibm	websphere_application_server	6.0.2	cpe:2.3:a:ibm:websphere_application_server:6.0.2:::::::*
ibm	websphere_application_server	6.0.2.4	cpe:2.3:a:ibm:websphere_application_server:6.0.2.4:::::::*
ibm	websphere_application_server	6.0.2.6	cpe:2.3:a:ibm:websphere_application_server:6.0.2.6:::::::*
ibm	websphere_application_server	6.0.2.8	cpe:2.3:a:ibm:websphere_application_server:6.0.2.8:::::::*
ibm	websphere_application_server	6.0.2.10	cpe:2.3:a:ibm:websphere_application_server:6.0.2.10:::::::*
ibm	websphere_application_server	6.0.2.12	cpe:2.3:a:ibm:websphere_application_server:6.0.2.12:::::::*
ibm	websphere_application_server	6.0.2.14	cpe:2.3:a:ibm:websphere_application_server:6.0.2.14:::::::*
ibm	websphere_application_server	6.0.2.16	cpe:2.3:a:ibm:websphere_application_server:6.0.2.16:::::::*
ibm	websphere_application_server	6.0.2.18	cpe:2.3:a:ibm:websphere_application_server:6.0.2.18:::::::*

Rows per page:

1-10 of 141

References

www-01.ibm.com/support/docview.wss?uid=swg27006876

www-1.ibm.com/support/docview.wss?uid=swg1PK71143

www.securityfocus.com/bid/33884

exchange.xforce.ibmcloud.com/vulnerabilities/48886

CVSS2

6.2

Attack Vector

LOCAL

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:H/Au:N/C:C/I:C/A:C

AI Score

6.2

Confidence

Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2009-0506