CVE-2013-0540
First published: Wed Apr 24 2013(Updated: )
IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.0.2, when SSL is not enabled, does not properly validate authentication cookies, which allows remote authenticated users to bypass intended access restrictions via an HTTP session.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM WebSphere Application Server Feature Pack for Web Services | =8.5.0.0 | |
| IBM WebSphere Application Server Feature Pack for Web Services | =8.5.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-0540?
CVE-2013-0540 is classified as a moderate severity vulnerability.
How do I fix CVE-2013-0540?
To fix CVE-2013-0540, upgrade to IBM WebSphere Application Server Liberty Profile version 8.5.0.2 or later.
Who is affected by CVE-2013-0540?
CVE-2013-0540 affects users of IBM WebSphere Application Server Liberty Profile versions 8.5.0.0 and 8.5.0.1 when SSL is not enabled.
What is the primary issue with CVE-2013-0540?
The primary issue with CVE-2013-0540 is that it allows remote authenticated users to bypass intended access restrictions due to improper validation of authentication cookies.
Is SSL necessary to mitigate CVE-2013-0540?
Yes, enabling SSL may provide some additional protection, but it is not a complete mitigation for CVE-2013-0540.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm websphere application server feature pack for web services
- version/ibm websphere application server feature pack for web services/8.5.0.0
- version/ibm websphere application server feature pack for web services/8.5.0.1