Lucene search
HistoryOct 30, 2011 - 10:55 a.m.
CVE-2009-2747
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
AI Score
5.8
Confidence
High
EPSS
0.003
Percentile
65.6%
The Java Naming and Directory Interface (JNDI) implementation in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 does not properly restrict access to UserRegistry object methods, which allows remote attackers to obtain sensitive information via a crafted method call.
Affected configurations
Node
ibmwebsphere_application_serverMatch6.0
ORibmwebsphere_application_serverMatch6.0.0.1
ORibmwebsphere_application_serverMatch6.0.0.2
ORibmwebsphere_application_serverMatch6.0.0.3
ORibmwebsphere_application_serverMatch6.0.1
ORibmwebsphere_application_serverMatch6.0.1.1
ORibmwebsphere_application_serverMatch6.0.1.2
ORibmwebsphere_application_serverMatch6.0.1.3
ORibmwebsphere_application_serverMatch6.0.1.5
ORibmwebsphere_application_serverMatch6.0.1.7
ORibmwebsphere_application_serverMatch6.0.1.9
ORibmwebsphere_application_serverMatch6.0.1.11
ORibmwebsphere_application_serverMatch6.0.1.13
ORibmwebsphere_application_serverMatch6.0.1.15
ORibmwebsphere_application_serverMatch6.0.1.17
ORibmwebsphere_application_serverMatch6.0.2
ORibmwebsphere_application_serverMatch6.0.2.1
ORibmwebsphere_application_serverMatch6.0.2.2
ORibmwebsphere_application_serverMatch6.0.2.3
ORibmwebsphere_application_serverMatch6.0.2.4
ORibmwebsphere_application_serverMatch6.0.2.5
ORibmwebsphere_application_serverMatch6.0.2.6
ORibmwebsphere_application_serverMatch6.0.2.7
ORibmwebsphere_application_serverMatch6.0.2.9
ORibmwebsphere_application_serverMatch6.0.2.11
ORibmwebsphere_application_serverMatch6.0.2.13
ORibmwebsphere_application_serverMatch6.0.2.15
ORibmwebsphere_application_serverMatch6.0.2.17
ORibmwebsphere_application_serverMatch6.0.2.19
ORibmwebsphere_application_serverMatch6.0.2.22
ORibmwebsphere_application_serverMatch6.0.2.23
ORibmwebsphere_application_serverMatch6.0.2.24
ORibmwebsphere_application_serverMatch6.0.2.25
ORibmwebsphere_application_serverMatch6.0.2.27
ORibmwebsphere_application_serverMatch6.0.2.28
ORibmwebsphere_application_serverMatch6.0.2.29
ORibmwebsphere_application_serverMatch6.0.2.30
ORibmwebsphere_application_serverMatch6.0.2.31
ORibmwebsphere_application_serverMatch6.0.2.32
ORibmwebsphere_application_serverMatch6.0.2.33
ORibmwebsphere_application_serverMatch6.0.2.35
ORibmwebsphere_application_serverMatch6.0.2.37
Node
ibmwebsphere_application_serverMatch6.1.0
ORibmwebsphere_application_serverMatch6.1.0.0
ORibmwebsphere_application_serverMatch6.1.0.1
ORibmwebsphere_application_serverMatch6.1.0.2
ORibmwebsphere_application_serverMatch6.1.0.5
ORibmwebsphere_application_serverMatch6.1.0.7
ORibmwebsphere_application_serverMatch6.1.0.9
ORibmwebsphere_application_serverMatch6.1.0.11
ORibmwebsphere_application_serverMatch6.1.0.12
ORibmwebsphere_application_serverMatch6.1.0.15
ORibmwebsphere_application_serverMatch6.1.0.17
ORibmwebsphere_application_serverMatch6.1.0.19
ORibmwebsphere_application_serverMatch6.1.0.21
ORibmwebsphere_application_serverMatch6.1.0.23
ORibmwebsphere_application_serverMatch6.1.0.25
ORibmwebsphere_application_serverMatch6.1.0.27
Node
ibmwebsphere_application_serverMatch7.0
ORibmwebsphere_application_serverMatch7.0.0.1
ORibmwebsphere_application_serverMatch7.0.0.2
ORibmwebsphere_application_serverMatch7.0.0.3
ORibmwebsphere_application_serverMatch7.0.0.4
ORibmwebsphere_application_serverMatch7.0.0.5
ORibmwebsphere_application_serverMatch7.0.0.6
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ibm | websphere_application_server | 6.0 | cpe:2.3:a:ibm:websphere_application_server:6.0:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.0.1 | cpe:2.3:a:ibm:websphere_application_server:6.0.0.1:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.0.2 | cpe:2.3:a:ibm:websphere_application_server:6.0.0.2:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.0.3 | cpe:2.3:a:ibm:websphere_application_server:6.0.0.3:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.1 | cpe:2.3:a:ibm:websphere_application_server:6.0.1:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.1.1 | cpe:2.3:a:ibm:websphere_application_server:6.0.1.1:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.1.2 | cpe:2.3:a:ibm:websphere_application_server:6.0.1.2:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.1.3 | cpe:2.3:a:ibm:websphere_application_server:6.0.1.3:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.1.5 | cpe:2.3:a:ibm:websphere_application_server:6.0.1.5:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.1.7 | cpe:2.3:a:ibm:websphere_application_server:6.0.1.7:*:*:*:*:*:*:* |
Related
openvas
openvas
IBM WebSphere Application Server JNDI information disclosure Vulnerability
2011-11-04 00:00:00
IBM WebSphere Application Server JNDI information disclosure Vulnerability
2011-11-04 00:00:00
cvelist
cvelist
CVE-2009-2747
2011-10-30 10:00:00
nessus
nessus
IBM WebSphere Application Server 6.0 < 6.0.2.39 Multiple Vulnerabilities
2010-02-11 00:00:00
IBM WebSphere Application Server < 6.1.0.29 Multiple Vulnerabilities
2011-10-31 00:00:00
IBM WebSphere Application Server 7.0 < Fix Pack 7
2009-11-13 00:00:00
cve
cve
CVE-2009-2747
2011-10-30 10:55:02
prion
prion
Security feature bypass
2011-10-30 10:55:00
seebug
seebug
IBM WebSphereๅบ็จๆๅกๅจ็ฎก็ๆงๅถๅฐ่ทจ็ซ่ๆฌๆผๆด
2009-11-16 00:00:00
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
AI Score
5.8
Confidence
High
EPSS
0.003
Percentile
65.6%
Related for NVD:CVE-2009-2747