CVE-2009-0507
IBM WebSphere Process Server (WPS) 6.1.2 before 6.1.2.3 and 6.2 before 6.2.0.1 does not properly restrict configuration data during an export of the cluster configuration file from the administrative console, which allows remote authenticated users to…
Does this matter?
Lower severity and a low EPSS score (1.00%). Track it; it rarely justifies an emergency change on its own.
Description
IBM WebSphere Process Server (WPS) 6.1.2 before 6.1.2.3 and 6.2 before 6.2.0.1 does not properly restrict configuration data during an export of the cluster configuration file from the administrative console, which allows remote authenticated users to obtain the (1) JMSAPI, (2) ESCALATION, and (3) MAILSESSION (aka mail session) cleartext passwords via vectors involving access to a cluster member.
- CVSS 2.0
- 4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
- EPSS
- 1.00% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-16
- Affected
- ibm/websphere process server
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/34249
- http://www-01.ibm.com/support/docview.wss?uid=swg27015580
- http://www-1.ibm.com/support/docview.wss?uid=swg1JR30088Vendor Advisory
- http://www.vupen.com/english/advisories/2009/0670
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48892
- http://secunia.com/advisories/34249
- http://www-01.ibm.com/support/docview.wss?uid=swg27015580
- http://www-1.ibm.com/support/docview.wss?uid=swg1JR30088Vendor Advisory
- http://www.vupen.com/english/advisories/2009/0670
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48892
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.