Lucene search
HistorySep 08, 2009 - 10:30 p.m.
CVE-2009-3106
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
AI Score
7.3
Confidence
High
EPSS
0.001
Percentile
41.9%
The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.37 does not properly implement security constraints on the (1) doGet and (2) doTrace methods, which allows remote attackers to bypass intended access restrictions and obtain sensitive information via a crafted HTTP HEAD request to a Web Application.
Affected configurations
Node
ibmwebsphere_application_serverMatch6.0.2
ORibmwebsphere_application_serverMatch6.0.2fp17
ORibmwebsphere_application_serverMatch6.0.2.1
ORibmwebsphere_application_serverMatch6.0.2.2
ORibmwebsphere_application_serverMatch6.0.2.3
ORibmwebsphere_application_serverMatch6.0.2.4
ORibmwebsphere_application_serverMatch6.0.2.5
ORibmwebsphere_application_serverMatch6.0.2.6
ORibmwebsphere_application_serverMatch6.0.2.7
ORibmwebsphere_application_serverMatch6.0.2.8
ORibmwebsphere_application_serverMatch6.0.2.9
ORibmwebsphere_application_serverMatch6.0.2.10
ORibmwebsphere_application_serverMatch6.0.2.11
ORibmwebsphere_application_serverMatch6.0.2.12
ORibmwebsphere_application_serverMatch6.0.2.13
ORibmwebsphere_application_serverMatch6.0.2.14
ORibmwebsphere_application_serverMatch6.0.2.15
ORibmwebsphere_application_serverMatch6.0.2.16
ORibmwebsphere_application_serverMatch6.0.2.17
ORibmwebsphere_application_serverMatch6.0.2.18
ORibmwebsphere_application_serverMatch6.0.2.19
ORibmwebsphere_application_serverMatch6.0.2.20
ORibmwebsphere_application_serverMatch6.0.2.21
ORibmwebsphere_application_serverMatch6.0.2.22
ORibmwebsphere_application_serverMatch6.0.2.23
ORibmwebsphere_application_serverMatch6.0.2.24
ORibmwebsphere_application_serverMatch6.0.2.25
ORibmwebsphere_application_serverMatch6.0.2.27
ORibmwebsphere_application_serverMatch6.0.2.28
ORibmwebsphere_application_serverMatch6.0.2.29
ORibmwebsphere_application_serverMatch6.0.2.30
ORibmwebsphere_application_serverMatch6.0.2.31
ORibmwebsphere_application_serverMatch6.0.2.32
ORibmwebsphere_application_serverMatch6.0.2.33
ORibmwebsphere_application_serverMatch6.0.2.35
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ibm | websphere_application_server | 6.0.2 | cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.2 | cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:fp17:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.2.1 | cpe:2.3:a:ibm:websphere_application_server:6.0.2.1:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.2.2 | cpe:2.3:a:ibm:websphere_application_server:6.0.2.2:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.2.3 | cpe:2.3:a:ibm:websphere_application_server:6.0.2.3:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.2.4 | cpe:2.3:a:ibm:websphere_application_server:6.0.2.4:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.2.5 | cpe:2.3:a:ibm:websphere_application_server:6.0.2.5:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.2.6 | cpe:2.3:a:ibm:websphere_application_server:6.0.2.6:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.2.7 | cpe:2.3:a:ibm:websphere_application_server:6.0.2.7:*:*:*:*:*:*:* |
| ibm | websphere_application_server | 6.0.2.8 | cpe:2.3:a:ibm:websphere_application_server:6.0.2.8:*:*:*:*:*:*:* |
Related
cvelist
cvelist
CVE-2009-3106
2009-09-08 22:00:00
prion
prion
Design/Logic Flaw
2009-09-08 22:30:00
cve
cve
CVE-2009-3106
2009-09-08 22:30:00
nessus
nessus
IBM WebSphere Application Server 7.0 < Fix Pack 7
2009-11-13 00:00:00
IBM WebSphere Application Server < 6.1.0.27 Multiple Vulnerabilities
2009-09-23 00:00:00
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
AI Score
7.3
Confidence
High
EPSS
0.001
Percentile
41.9%
Related for NVD:CVE-2009-3106