CVE-2009-0504: Infoleak
Published Feb 17, 2009
·Updated
WSPolicy in the Web Services component in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.1 does not properly recognize the IDAssertion.isUsed binding property, which allows local users to discover a password by reading a SOAP message.
Affected Software
1 affected component
IBM WebSphere Application Server Feature Pack for Web Services<=7.0
Remediation
Patch Available
Event History
Feb 17, 2009
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Data Sourced
via NVD·05:30 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2009-0504?
The severity of CVE-2009-0504 is classified as a moderate vulnerability, as it can lead to password disclosure.
2
How do I fix CVE-2009-0504?
Fix CVE-2009-0504 by upgrading to IBM WebSphere Application Server version 7.0.0.1 or later.
3
Who is affected by CVE-2009-0504?
CVE-2009-0504 affects IBM WebSphere Application Server versions up to 7.0.
4
What type of attack does CVE-2009-0504 enable?
CVE-2009-0504 enables local users to discover passwords by reading SOAP messages due to improper recognition of the IDAssertion.isUsed binding property.
5
When was CVE-2009-0504 published?
CVE-2009-0504 was published on February 18, 2009.