Vulnerability Intelligence Report
CVE-2009-0506
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 5.1 and 6.0.2 before 6.0.2.33 on z/OS, when CSIv2 Identity Assertion is enabled and Enterprise JavaBeans (EJB) interaction occurs between a WAS 6.1 instance and a WAS pre-6.1 instance, allows local users to have an unknown impact via vectors related to (1) use of the wrong subject and (2) multiple CBIND checks.
No Active Exploit Signals
CVSS Base Score
6.2
MEDIUM
EPSS Probability:0.27%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| ibm | websphere_application_server | 5.1.0, 6.0.2, 6.0.2.4, 6.0.2.6, 6.0.2.8, 6.0.2.10, 6.0.2.12, 6.0.2.14, 6.0.2.16, 6.0.2.18, 6.0.2.20, 6.0.2.22, 6.0.2.24 |
| ibm | z\/os | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.271%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2009-02-10T00:00:00 |
| Published | 2009-02-25T16:00:00 |
| Patch Date | 2009-02-24 |
| Last Updated | 2024-08-07T04:40:03 |
Community Chatter & Buzz