CVE-2009-2092: High severity IBM WebSphere Application Server Feature Pack for Web Services vulnerability
Published Aug 13, 2009
·Updated
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 does not properly read the portletServingEnabled parameter in ibm-portlet-ext.xmi, which allows remote attackers to bypass intended access restrictions via unknown vectors.
Affected Software
4 affected components
IBM WebSphere Application Server Feature Pack for Web Services=7.0
IBM WebSphere Application Server Feature Pack for Web Services=7.0.0.1
IBM WebSphere Application Server Feature Pack for Web Services=7.0.0.3
IBM WebSphere Application Server Feature Pack for Web Services=7.0.0.4
Remediation
Patch Available
Event History
Aug 13, 2009
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-2092?
CVE-2009-2092 has a medium severity level due to its ability to allow unauthorized access.
2
How do I fix CVE-2009-2092?
To fix CVE-2009-2092, upgrade IBM WebSphere Application Server to version 7.0.0.5 or later.
3
What software versions are affected by CVE-2009-2092?
CVE-2009-2092 affects IBM WebSphere Application Server versions 7.0.0.1 through 7.0.0.4.
4
What vulnerabilities does CVE-2009-2092 exploit?
CVE-2009-2092 exploits improper handling of the portletServingEnabled parameter to bypass access restrictions.
5
Can CVE-2009-2092 be exploited remotely?
Yes, CVE-2009-2092 can be exploited remotely by attackers to gain unauthorized access.