CVE-2013-0540

2013-04-2410:28:37

CWE-287

ibm

web.nvd.nist.gov

ibm

websphere

application server

liberty profile

cve-2013-0540

ssl

authentication

cookie validation

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

44.2%

JSON

IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.0.2, when SSL is not enabled, does not properly validate authentication cookies, which allows remote authenticated users to bypass intended access restrictions via an HTTP session.

Affected configurations

Nvd

Node

ibmwebsphere_application_serverMatch8.5.0.0-liberty_profile

ibmwebsphere_application_serverMatch8.5.0.1-liberty_profile

VendorProductVersionCPE
ibmwebsphere_application_server8.5.0.0cpe:2.3:a:ibm:websphere_application_server:8.5.0.0:-:liberty_profile:*:*:*:*:*
ibmwebsphere_application_server8.5.0.1cpe:2.3:a:ibm:websphere_application_server:8.5.0.1:-:liberty_profile:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	websphere_application_server	8.5.0.0	cpe:2.3:a:ibm:websphere_application_server:8.5.0.0:-:liberty_profile:::::*
ibm	websphere_application_server	8.5.0.1	cpe:2.3:a:ibm:websphere_application_server:8.5.0.1:-:liberty_profile:::::*