« Volver al listado

CVE-2009-0507

Estado: ModificadaMedia (4)—

IBM WebSphere Process Server (WPS) 6.1.2 before 6.1.2.3 and 6.2 before 6.2.0.1 does not properly restrict configuration data during an export of the cluster configuration file from the administrative console, which allows remote authenticated users to obtain the (1) JMSAPI, (2) ESCALATION, and (3) MAILSESSION (aka mail session) cleartext passwords via vectors involving access to a cluster member.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — Websphere Process Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-0507",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-02-26T16:17:19.843",
  "references": [
    {
      "url": "http://secunia.com/advisories/34249",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27015580",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1JR30088",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/0670",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48892",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/34249",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27015580",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1JR30088",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/0670",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48892",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-16"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM WebSphere Process Server (WPS) 6.1.2 before 6.1.2.3 and 6.2 before 6.2.0.1 does not properly restrict configuration data during an export of the cluster configuration file from the administrative console, which allows remote authenticated users to obtain the (1) JMSAPI, (2) ESCALATION, and (3) MAILSESSION (aka mail session) cleartext passwords via vectors involving access to a cluster member."
    },
    {
      "lang": "es",
      "value": "IBM WebSphere Process Server (WPS) v6.1.2 anteriores v6.1.2.3 y v6.2 anteriores a v6.2.1.0 no restringen apropiadamente los datos de configuración durante una exportación del archivo de configuración en cluster desde la consola de administración, lo que permite a usuarios remotos autenticados obtener (1) información JMSAPI y (2) información de sesión del correo a través de vectores que implica el acceso a un componente del cluster."
    }
  ],
  "lastModified": "2026-06-16T23:05:11.277",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:websphere_process_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B6EE919-5BD1-4F77-9869-A3B7EC38B220",
              "versionEndIncluding": "6.1.2.2"
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_process_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2BD7097A-FBE2-432C-8A76-426181C8F6A5",
              "versionEndIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_process_server:6.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07586269-73DA-4189-B0BD-95D4B0091FAD"
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_process_server:6.1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D43CB11-E506-4014-899E-417BDF7E0929"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}