Lucene search

[email protected]CVE-2011-1321

HistoryOct 03, 2022 - 4:15 p.m.

CVE-2011-1321

2022-10-0316:15:08

CWE-264

[email protected]

web.nvd.nist.gov

cve-2011-1321

ibm

websphere application server

was

security component

authcache

purge

implementation

vulnerability

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

6.4 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

57.8%

JSON

The AuthCache purge implementation in the Security component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.37 and 7.x before 7.0.0.15 does not purge a user from the PlatformCredential cache, which might allow remote authenticated users to gain privileges by leveraging a group membership specified in an old RACF Object (aka RACO).

Affected configurations

NVD

Node

ibmwebsphere_application_serverMatch6.1.0

ibmwebsphere_application_serverMatch6.1.0.0

ibmwebsphere_application_serverMatch6.1.0.1

ibmwebsphere_application_serverMatch6.1.0.2

ibmwebsphere_application_serverMatch6.1.0.3

ibmwebsphere_application_serverMatch6.1.0.5

ibmwebsphere_application_serverMatch6.1.0.7

ibmwebsphere_application_serverMatch6.1.0.9

ibmwebsphere_application_serverMatch6.1.0.11

ibmwebsphere_application_serverMatch6.1.0.12

ibmwebsphere_application_serverMatch6.1.0.15

ibmwebsphere_application_serverMatch6.1.0.17

ibmwebsphere_application_serverMatch6.1.0.19

ibmwebsphere_application_serverMatch6.1.0.21

ibmwebsphere_application_serverMatch6.1.0.23

ibmwebsphere_application_serverMatch6.1.0.25

ibmwebsphere_application_serverMatch6.1.0.27

ibmwebsphere_application_serverMatch6.1.0.29

ibmwebsphere_application_serverMatch6.1.0.31

ibmwebsphere_application_serverMatch6.1.0.33

ibmwebsphere_application_serverMatch6.1.0.35

Node

ibmwebsphere_application_serverMatch7.0

ibmwebsphere_application_serverMatch7.0.0.1

ibmwebsphere_application_serverMatch7.0.0.2

ibmwebsphere_application_serverMatch7.0.0.3

ibmwebsphere_application_serverMatch7.0.0.4

ibmwebsphere_application_serverMatch7.0.0.5

ibmwebsphere_application_serverMatch7.0.0.6

ibmwebsphere_application_serverMatch7.0.0.7

ibmwebsphere_application_serverMatch7.0.0.8

ibmwebsphere_application_serverMatch7.0.0.9

ibmwebsphere_application_serverMatch7.0.0.11

ibmwebsphere_application_serverMatch7.0.0.13

CPENameOperatorVersion
ibm:websphere_application_serveribm websphere application servereq6.1.0
ibm:websphere_application_serveribm websphere application servereq6.1.0.0
ibm:websphere_application_serveribm websphere application servereq6.1.0.1
ibm:websphere_application_serveribm websphere application servereq6.1.0.2
ibm:websphere_application_serveribm websphere application servereq6.1.0.3
ibm:websphere_application_serveribm websphere application servereq6.1.0.5
ibm:websphere_application_serveribm websphere application servereq6.1.0.7
ibm:websphere_application_serveribm websphere application servereq6.1.0.9
ibm:websphere_application_serveribm websphere application servereq6.1.0.11
ibm:websphere_application_serveribm websphere application servereq6.1.0.12

CPE	Name	Operator	Version
ibm:websphere_application_server	ibm websphere application server	eq	6.1.0
ibm:websphere_application_server	ibm websphere application server	eq	6.1.0.0
ibm:websphere_application_server	ibm websphere application server	eq	6.1.0.1
ibm:websphere_application_server	ibm websphere application server	eq	6.1.0.2
ibm:websphere_application_server	ibm websphere application server	eq	6.1.0.3
ibm:websphere_application_server	ibm websphere application server	eq	6.1.0.5
ibm:websphere_application_server	ibm websphere application server	eq	6.1.0.7
ibm:websphere_application_server	ibm websphere application server	eq	6.1.0.9
ibm:websphere_application_server	ibm websphere application server	eq	6.1.0.11
ibm:websphere_application_server	ibm websphere application server	eq	6.1.0.12