CVE-2009-2085 — Improper Authentication in IBM Websphere Application Server

CWE-287 — Improper Authentication3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.3%
top 44.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Websphere Application Server
Timeline
PublishedAug 13
Latest updateMay 2

Description

The Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 does not properly handle use of Identity Assertion with CSIv2 Security, which allows remote attackers to bypass intended CSIv2 access restrictions via vectors involving Enterprise JavaBeans (EJB).

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

Patches

Patch: www-01.ibm.com ↗Patch: www-01.ibm.com ↗Patch: www-01.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-qq9j-3pwq-87gm: The Security component in IBM WebSphere Application Server (WAS) 6↗2022-05-02
▶
CVEList
CVE-2009-2085: The Security component in IBM WebSphere Application Server (WAS) 6↗2009-08-13
▶
CVE-2009-2085 — Improper Authentication in IBM | cvebase