Vulnerability Name:

CVE-2009-0504 (CCN-48700)

Assigned:2009-02-12
Published:2009-02-12
Updated:2017-08-08
Summary:WSPolicy in the Web Services component in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.1 does not properly recognize the IDAssertion.isUsed binding property, which allows local users to discover a password by reading a SOAP message.
CVSS v3 Severity:2.2 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
1.6 Low (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
1.0 Low (CCN CVSS v2 Vector: AV:L/AC:H/Au:S/C:P/I:N/A:N)
0.7 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:H/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-200
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2009-0504

Source: CCN
Type: IBM Support & downloads
Fix list for IBM WebSphere Application Server version 7.0

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg27014463

Source: AIXAPAR
Type: Vendor Advisory
PK73573

Source: CCN
Type: OSVDB ID: 52600
IBM WebSphere Application Server (WAS) Web Services WSPolicy IDAssertion.isUsed SOAP Message Password Disclosure

Source: CCN
Type: BID-33879
IBM WebSphere Application Server WSPolicy Information Disclosure Vulnerability

Source: XF
Type: UNKNOWN
websphere-wspolicy-information-disclosure(48700)

Source: XF
Type: UNKNOWN
websphere-wspolicy-information-disclosure(48700)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:ibm:websphere_application_server:*:*:*:*:*:*:*:* (Version <= 7.0)

    • Configuration CCN 1:
  • cpe:/a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    ibm websphere application server *
    ibm websphere application server 7.0