CVE-2013-0540

IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.0.2, when SSL is not enabled, does not properly validate authentication cookies, which allows remote authenticated users to bypass intended access restrictions via an HTTP session.

CVSS v2.0 3.5 LOW

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?&uid=swg21632423	Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PM81056
https://exchange.xforce.ibmcloud.com/vulnerabilities/82695
http://www-01.ibm.com/support/docview.wss?&uid=swg21632423	Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PM81056
https://exchange.xforce.ibmcloud.com/vulnerabilities/82695

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:websphere_application_server:8.5.0.0:-:liberty_profile:::::*
	cpe:2.3:a:ibm:websphere_application_server:8.5.0.1:-:liberty_profile:::::*

History

21 Nov 2024, 01:47

Type	Values Removed	Values Added
References	~~() http://www-01.ibm.com/support/docview.wss?&uid=swg21632423 - Vendor Advisory~~	() http://www-01.ibm.com/support/docview.wss?&uid=swg21632423 - Vendor Advisory
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg1PM81056 -~~	() http://www-01.ibm.com/support/docview.wss?uid=swg1PM81056 -
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/82695 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/82695 -

Information

Published : 2013-04-24 10:28

Updated : 2024-11-21 01:47

NVD link : CVE-2013-0540

Mitre link : CVE-2013-0540

CVE.ORG link : CVE-2013-0540

JSON object : View

Products Affected

ibm

websphere_application_server

CWE

CWE-287

Improper Authentication

{"id": "CVE-2013-0540", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-04-24T10:28:37.470", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?&uid=swg21632423", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM81056", "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82695", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?&uid=swg21632423", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM81056", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82695", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.0.2, when SSL is not enabled, does not properly validate authentication cookies, which allows remote authenticated users to bypass intended access restrictions via an HTTP session."}, {"lang": "es", "value": "IBM WebSphere Application Server (WAS) Liberty Profile v8.5 antes de v8.5.0.2, cuando SSL no est\u00e1 habilitado, no se valida correctamente las cookies de autenticaci\u00f3n, lo que permite a usuarios remotos autenticados eludir las restricciones de acceso destinados a trav\u00e9s de una sesi\u00f3n HTTP."}], "lastModified": "2024-11-21T01:47:45.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:websphere_application_server:8.5.0.0:-:liberty_profile:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C59741DC-50CD-4F5A-BCB1-EB3B9AD58662"}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:8.5.0.1:-:liberty_profile:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24016607-3BB3-409E-B2A3-C8A19CE9FB15"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}