CVE-2009-2749 — IBM Communications Enabled Applications vulnerability

CWE-3103 documents3 sources
Severity
6.4MEDIUMNVD
EPSS
0.4%
top 37.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Communications Enabled ApplicationsIBM Websphere Application Server
Timeline
PublishedDec 8
Latest updateMay 2

Description

Feature Pack for Communications Enabled Applications (CEA) before 1.0.0.1 for IBM WebSphere Application Server 7.0.0.7 uses predictable session values, which allows man-in-the-middle attackers to spoof a collaboration session by guessing the value.

CVSS vector

AV:N/AC:L/C:N/I:P/A:PExploitability: 10.0 | Impact: 4.9

Affected Packages2 packages

Patches

Patch: www-01.ibm.com ↗Patch: www-01.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-43w7-r28v-f9wx: Feature Pack for Communications Enabled Applications (CEA) before 1↗2022-05-02
▶
CVEList
CVE-2009-2749: Feature Pack for Communications Enabled Applications (CEA) before 1↗2009-12-08
▶
CVE-2009-2749 — IBM vulnerability | cvebase