Unscored severity · published Jun 3, 2009
CVE-2009-0899
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.24 and 7.0 through 7.0.0.4, IBM WebSphere Portal Server 5.1 through 6.0, and IBM Integrated Solutions Console (ISC) 6.0.1…
–
CVSS
1.6%
EPSS
No
On KEV
Description
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.24 and 7.0 through 7.0.0.4, IBM WebSphere Portal Server 5.1 through 6.0, and IBM Integrated Solutions Console (ISC) 6.0.1 do not properly set the IsSecurityEnabled security flag during migration of WebSphere Member Manager (WMM) to Virtual Member Manager (VMM) and a Federated Repository, which allows attackers to obtain sensitive information from repositories via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
Integrated Solutions Console · Ibm
6.0.1 · source: NVD
WA
Websphere Application Server · Ibm
6.1 through 6.1.0.24; 7.0 through 7.0.0.4 · source: NVD
WP
Websphere Portal · Ibm
5.1 before 6.0.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-0899
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-0899
Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21375859
Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1PK78134
Third Party Advisory
http://www.securityfocus.com/bid/35406
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/50882