VulnerabilityModified
CVE-2010-0563
The Single Sign-on (SSO) functionality in IBM WebSphere Application Server (WAS) 7.0.0.0 through 7.0.0.8 does not recognize the Requires SSL configuration option, which might allow remote attackers to obtain sensitive information by sniffing network…
MEDIUM 5.0EPSS 2.17%
Does this matter?
Lower severity and a low EPSS score (2.17%). Track it; it rarely justifies an emergency change on its own.
Description
The Single Sign-on (SSO) functionality in IBM WebSphere Application Server (WAS) 7.0.0.0 through 7.0.0.8 does not recognize the Requires SSL configuration option, which might allow remote attackers to obtain sensitive information by sniffing network sessions that were expected to be encrypted.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 2.17% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- ibm/websphere application server
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/38425Vendor Advisory
- http://securitytracker.com/id?1023551
- http://www-01.ibm.com/support/docview.wss?uid=swg21417839Patch, Vendor Advisory
- http://www-1.ibm.com/support/docview.wss?uid=swg1PM00610
- http://www.osvdb.org/62140
- http://www.securityfocus.com/bid/38122
- http://secunia.com/advisories/38425Vendor Advisory
- http://securitytracker.com/id?1023551
- http://www-01.ibm.com/support/docview.wss?uid=swg21417839Patch, Vendor Advisory
- http://www-1.ibm.com/support/docview.wss?uid=swg1PM00610
- http://www.osvdb.org/62140
- http://www.securityfocus.com/bid/38122
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.