Lucene search
MitreCVE-2009-2747HistoryOct 30, 2011 - 10:55 a.m.
CVE-2009-2747
2011-10-3010:55:02
CWE-264
mitre
web.nvd.nist.gov
31
ibm
websphere
application server
jndi
cve-2009-2747
security vulnerability
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
AI Score
5.8
Confidence
Low
EPSS
0.003
Percentile
65.6%
The Java Naming and Directory Interface (JNDI) implementation in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 does not properly restrict access to UserRegistry object methods, which allows remote attackers to obtain sensitive information via a crafted method call.
Affected configurations
Node
ibmwebsphere_application_serverMatch6.0
ORibmwebsphere_application_serverMatch6.0.0.1
ORibmwebsphere_application_serverMatch6.0.0.2
ORibmwebsphere_application_serverMatch6.0.0.3
ORibmwebsphere_application_serverMatch6.0.1
ORibmwebsphere_application_serverMatch6.0.1.1
ORibmwebsphere_application_serverMatch6.0.1.2
ORibmwebsphere_application_serverMatch6.0.1.3
ORibmwebsphere_application_serverMatch6.0.1.5
ORibmwebsphere_application_serverMatch6.0.1.7
ORibmwebsphere_application_serverMatch6.0.1.9
ORibmwebsphere_application_serverMatch6.0.1.11
ORibmwebsphere_application_serverMatch6.0.1.13
ORibmwebsphere_application_serverMatch6.0.1.15
ORibmwebsphere_application_serverMatch6.0.1.17
ORibmwebsphere_application_serverMatch6.0.2
ORibmwebsphere_application_serverMatch6.0.2.1
ORibmwebsphere_application_serverMatch6.0.2.2
ORibmwebsphere_application_serverMatch6.0.2.3
ORibmwebsphere_application_serverMatch6.0.2.4
ORibmwebsphere_application_serverMatch6.0.2.5
ORibmwebsphere_application_serverMatch6.0.2.6
ORibmwebsphere_application_serverMatch6.0.2.7
ORibmwebsphere_application_serverMatch6.0.2.9
ORibmwebsphere_application_serverMatch6.0.2.11
ORibmwebsphere_application_serverMatch6.0.2.13
ORibmwebsphere_application_serverMatch6.0.2.15
ORibmwebsphere_application_serverMatch6.0.2.17
ORibmwebsphere_application_serverMatch6.0.2.19
ORibmwebsphere_application_serverMatch6.0.2.22
ORibmwebsphere_application_serverMatch6.0.2.23
ORibmwebsphere_application_serverMatch6.0.2.24
ORibmwebsphere_application_serverMatch6.0.2.25
ORibmwebsphere_application_serverMatch6.0.2.27
ORibmwebsphere_application_serverMatch6.0.2.28
ORibmwebsphere_application_serverMatch6.0.2.29
ORibmwebsphere_application_serverMatch6.0.2.30
ORibmwebsphere_application_serverMatch6.0.2.31
ORibmwebsphere_application_serverMatch6.0.2.32
ORibmwebsphere_application_serverMatch6.0.2.33
ORibmwebsphere_application_serverMatch6.0.2.35
ORibmwebsphere_application_serverMatch6.0.2.37
Node
ibmwebsphere_application_serverMatch6.1.0
ORibmwebsphere_application_serverMatch6.1.0.0
ORibmwebsphere_application_serverMatch6.1.0.1
ORibmwebsphere_application_serverMatch6.1.0.2
ORibmwebsphere_application_serverMatch6.1.0.5
ORibmwebsphere_application_serverMatch6.1.0.7
ORibmwebsphere_application_serverMatch6.1.0.9
ORibmwebsphere_application_serverMatch6.1.0.11
ORibmwebsphere_application_serverMatch6.1.0.12
ORibmwebsphere_application_serverMatch6.1.0.15
ORibmwebsphere_application_serverMatch6.1.0.17
ORibmwebsphere_application_serverMatch6.1.0.19
ORibmwebsphere_application_serverMatch6.1.0.21
ORibmwebsphere_application_serverMatch6.1.0.23
ORibmwebsphere_application_serverMatch6.1.0.25
ORibmwebsphere_application_serverMatch6.1.0.27
Node
ibmwebsphere_application_serverMatch7.0
ORibmwebsphere_application_serverMatch7.0.0.1
ORibmwebsphere_application_serverMatch7.0.0.2
ORibmwebsphere_application_serverMatch7.0.0.3
ORibmwebsphere_application_serverMatch7.0.0.4
ORibmwebsphere_application_serverMatch7.0.0.5
ORibmwebsphere_application_serverMatch7.0.0.6
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ibm | websphere_application_server | 6.0 | cpe:2.3:a:ibm:websphere_application_server:6.0:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.0.1 | cpe:2.3:a:ibm:websphere_application_server:6.0.0.1:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.0.2 | cpe:2.3:a:ibm:websphere_application_server:6.0.0.2:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.0.3 | cpe:2.3:a:ibm:websphere_application_server:6.0.0.3:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.1 | cpe:2.3:a:ibm:websphere_application_server:6.0.1:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.1.1 | cpe:2.3:a:ibm:websphere_application_server:6.0.1.1:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.1.2 | cpe:2.3:a:ibm:websphere_application_server:6.0.1.2:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.1.3 | cpe:2.3:a:ibm:websphere_application_server:6.0.1.3:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.1.5 | cpe:2.3:a:ibm:websphere_application_server:6.0.1.5:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.1.7 | cpe:2.3:a:ibm:websphere_application_server:6.0.1.7:*:*:*:*:*:*:* |
Related
openvas
openvas
IBM WebSphere Application Server JNDI information disclosure Vulnerability
2011-11-04 00:00:00
IBM WebSphere Application Server JNDI information disclosure Vulnerability
2011-11-04 00:00:00
cvelist
cvelist
CVE-2009-2747
2011-10-30 10:00:00
nvd
nvd
CVE-2009-2747
2011-10-30 10:55:02
nessus
nessus
IBM WebSphere Application Server 6.0 < 6.0.2.39 Multiple Vulnerabilities
2010-02-11 00:00:00
IBM WebSphere Application Server < 6.1.0.29 Multiple Vulnerabilities
2011-10-31 00:00:00
IBM WebSphere Application Server 7.0 < Fix Pack 7
2009-11-13 00:00:00
prion
prion
Security feature bypass
2011-10-30 10:55:00
seebug
seebug
IBM WebSphereๅบ็จๆๅกๅจ็ฎก็ๆงๅถๅฐ่ทจ็ซ่ๆฌๆผๆด
2009-11-16 00:00:00
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
AI Score
5.8
Confidence
Low
EPSS
0.003
Percentile
65.6%
Related for CVE-2009-2747