CVE-2009-1900 — Sensitive Information Exposure in IBM Websphere Application Server

CWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
5.0MEDIUMNVD
EPSS
0.6%
top 29.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Websphere Application Server
Timeline
PublishedJun 3
Latest updateMay 2

Description

The Configservice APIs in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.25, and 7.0 before 7.0.0.5, when tracing is enabled, allow remote attackers to obtain sensitive information via unspecified use of the wsadmin scripting tool.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

Patches

Patch: www-01.ibm.com ↗Patch: www.vupen.com ↗Patch: www-01.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-4qxr-4w4x-7j43: The Configservice APIs in the Administrative Console component in IBM WebSphere Application Server (WAS) 6↗2022-05-02
▶
CVEList
CVE-2009-1900: The Configservice APIs in the Administrative Console component in IBM WebSphere Application Server (WAS) 6↗2009-06-03
▶
CVE-2009-1900 — Sensitive Information Exposure in IBM | cvebase