CVE-2013-0540: Low severity ibm websphere application server feature pack for web services vulnerability
IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.0.2, when SSL is not enabled, does not properly validate authentication cookies, which allows remote authenticated users to bypass intended access restrictions via an HTTP session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0540?
CVE-2013-0540 is classified as a moderate severity vulnerability.
How do I fix CVE-2013-0540?
To fix CVE-2013-0540, upgrade to IBM WebSphere Application Server Liberty Profile version 8.5.0.2 or later.
Who is affected by CVE-2013-0540?
CVE-2013-0540 affects users of IBM WebSphere Application Server Liberty Profile versions 8.5.0.0 and 8.5.0.1 when SSL is not enabled.
What is the primary issue with CVE-2013-0540?
The primary issue with CVE-2013-0540 is that it allows remote authenticated users to bypass intended access restrictions due to improper validation of authentication cookies.
Is SSL necessary to mitigate CVE-2013-0540?
Yes, enabling SSL may provide some additional protection, but it is not a complete mitigation for CVE-2013-0540.