CVE-2009-0903

First published: Thu Jun 25 2009(Updated: )

IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3, and the Feature Pack for Web Services for WAS 6.1 before 6.1.0.25, when a WS-Security policy is established at the operation level, does not properly handle inbound requests that lack a SOAPAction or WS-Addressing Action, which allows remote attackers to bypass intended access restrictions via a crafted request to a JAX-WS application.

Credit: cve@mitre.org

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/author
• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/type
• agent/weakness
• collector/nvd-historical
• collector/nvd-index
• vendor/ibm
• canonical/ibm websphere application server
• version/ibm websphere application server/6.1.0.21
• version/ibm websphere application server/6.1
• version/ibm websphere application server/6.1.0.22
• version/ibm websphere application server/6.1.0.19
• version/ibm websphere application server/6.1.0.2
• version/ibm websphere application server/6.1.0.4
• version/ibm websphere application server/6.1.0.11
• version/ibm websphere application server/7.0
• version/ibm websphere application server/6.1.0.14
• version/ibm websphere application server/6.1.0.20
• version/ibm websphere application server/6.1.0.9
• version/ibm websphere application server/6.1.0.24
• version/ibm websphere application server/6.1.0.0
• version/ibm websphere application server/6.1.0.1
• version/ibm websphere application server/6.1.0.7
• version/ibm websphere application server/6.1.0.3
• version/ibm websphere application server/6.1.0.17
• version/ibm websphere application server/6.1.0.13
• version/ibm websphere application server/6.1.0.16
• version/ibm websphere application server/6.1.0.6
• version/ibm websphere application server/6.1.0.10
• version/ibm websphere application server/6.1.0.8
• version/ibm websphere application server/6.1.0.15
• version/ibm websphere application server/6.1.0.18
• version/ibm websphere application server/6.1.0.23
• version/ibm websphere application server/7.0.0.1
• version/ibm websphere application server/6.1.0
• version/ibm websphere application server/6.1.0.5
• version/ibm websphere application server/6.1.0.12