Vulnerability Name:

CVE-2011-1209 (CCN-67115)

Assigned:2011-04-15
Published:2011-04-15
Updated:2017-08-17
Summary:IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.39 and 7.0 before 7.0.0.17 uses a weak WS-Security XML encryption algorithm, which makes it easier for remote attackers to obtain plaintext data from a (1) JAX-RPC or (2) JAX-WS Web Services request via unspecified vectors related to a "decryption attack."
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-310
Vulnerability Consequences:Other
References:Source: MITRE
Type: CNA
CVE-2011-1209

Source: CCN
Type: IBM Support & downloads
*Updated* Potential security exposure with IBM WebSphere Application Server with Web Services using XML Encryption (PM34841/PM35779)

Source: AIXAPAR
Type: UNKNOWN
PM34841

Source: CCN
Type: IBM APAR PM34841
Potential security exposure with WebSphere Application Server

Source: CONFIRM
Type: Patch
http://www-01.ibm.com/support/docview.wss?uid=swg24029632

Source: CCN
Type: OSVDB ID: 73289
IBM WebSphere Application Server (WAS) WS-Security XML Encryption Algorithm Weakness Plaintext Data Disclosure

Source: XF
Type: UNKNOWN
was-xmlencryption-weak-security(67115)

Source: XF
Type: UNKNOWN
was-xmlencryption-weak-security(67115)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:ibm:websphere_application_server:6.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.15:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.17:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.19:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.21:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.22:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.23:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.24:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.25:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.27:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.29:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.31:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.32:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.33:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.35:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.0.37:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.13:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:6.1.14:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:ibm:websphere_application_server:7.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0.0.13:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0.0.15:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    ibm websphere application server 6.1.0
    ibm websphere application server 6.1.0.0
    ibm websphere application server 6.1.0.1
    ibm websphere application server 6.1.0.2
    ibm websphere application server 6.1.0.3
    ibm websphere application server 6.1.0.5
    ibm websphere application server 6.1.0.7
    ibm websphere application server 6.1.0.9
    ibm websphere application server 6.1.0.11
    ibm websphere application server 6.1.0.12
    ibm websphere application server 6.1.0.15
    ibm websphere application server 6.1.0.17
    ibm websphere application server 6.1.0.19
    ibm websphere application server 6.1.0.21
    ibm websphere application server 6.1.0.22
    ibm websphere application server 6.1.0.23
    ibm websphere application server 6.1.0.24
    ibm websphere application server 6.1.0.25
    ibm websphere application server 6.1.0.27
    ibm websphere application server 6.1.0.29
    ibm websphere application server 6.1.0.31
    ibm websphere application server 6.1.0.32
    ibm websphere application server 6.1.0.33
    ibm websphere application server 6.1.0.35
    ibm websphere application server 6.1.0.37
    ibm websphere application server 6.1.1
    ibm websphere application server 6.1.3
    ibm websphere application server 6.1.5
    ibm websphere application server 6.1.6
    ibm websphere application server 6.1.7
    ibm websphere application server 6.1.13
    ibm websphere application server 6.1.14
    ibm websphere application server 7.0.0.1
    ibm websphere application server 7.0.0.2
    ibm websphere application server 7.0.0.3
    ibm websphere application server 7.0.0.4
    ibm websphere application server 7.0.0.5
    ibm websphere application server 7.0.0.6
    ibm websphere application server 7.0.0.7
    ibm websphere application server 7.0.0.8
    ibm websphere application server 7.0.0.9
    ibm websphere application server 7.0.0.10
    ibm websphere application server 7.0.0.11
    ibm websphere application server 7.0.0.12
    ibm websphere application server 7.0.0.13
    ibm websphere application server 7.0.0.15
    ibm websphere application server 6.1
    ibm websphere application server 7.0