CVE-2009-1953

CWE-2643 documents3 sources
Severity
4.6MEDIUM
EPSS
0.6%
top 31.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Filenet Content Manager
Timeline
PublishedJun 8
Latest updateMay 2

Description

IBM FileNet Content Manager 4.0, 4.0.1, and 4.5, as used in IBM WebSphere Application Server (WAS) and Oracle BEA WebLogic Application Server, when the CE Web Services listener has a certain WSEAF configuration, does not properly restrict use of a cached Subject, which allows remote attackers to obtain access with the credentials of a recently authenticated user via unspecified vectors.

CVSS vector

AV:N/AC:H/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages1 packages

▶NVDibm/filenet_content_manager4.0, 4.0.1, 4.5+2

🔴Vulnerability Details

2
GHSA
GHSA-jc3c-whr2-jgwr: IBM FileNet Content Manager 4↗2022-05-02
▶
CVEList
CVE-2009-1953: IBM FileNet Content Manager 4↗2009-06-06
▶
CVE-2009-1953 (MEDIUM CVSS 4.6) | IBM FileNet Content Manager 4.0 | cvebase.io