Security feature bypass

2011-10-3010:55:00

PRIOn knowledge base

www.prio-n.com

6 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

65.6%

JSON

The Java Naming and Directory Interface (JNDI) implementation in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 does not properly restrict access to UserRegistry object methods, which allows remote attackers to obtain sensitive information via a crafted method call.

CPENameOperatorVersion
websphere_application_servereq6.0.2.1
websphere_application_servereq6.0.2.5
websphere_application_servereq6.0.0.3
websphere_application_servereq6.0.1.15
websphere_application_servereq6.0.1.3
websphere_application_servereq6.0.2.13
websphere_application_servereq6.0.2.9
websphere_application_servereq6.0.1.11
websphere_application_servereq6.0.2.28
websphere_application_servereq6.0.2.11

Name	Operator	Version
websphere_application_server	eq	6.0.2.1
websphere_application_server	eq	6.0.2.5
websphere_application_server	eq	6.0.0.3
websphere_application_server	eq	6.0.1.15
websphere_application_server	eq	6.0.1.3
websphere_application_server	eq	6.0.2.13
websphere_application_server	eq	6.0.2.9
websphere_application_server	eq	6.0.1.11
websphere_application_server	eq	6.0.2.28
websphere_application_server	eq	6.0.2.11