Security Bulletin: Possible security exposure with WebSphere Application Server with WS-Security enabled applications using LTPA tokens (PM43585/PM43792/PM45181)

Summary There is a possible security exposure when using WS-Security resulting in a user gaining elevated privileges. This impacts applications using either JAX-WS and JAX-RPC. Vulnerability Details WebSphere Application Server could provide weaker than expected security when using web services...

CVE-2011-1377

CVE-2011-1377 affects IBM WebSphere Application Server with WS-Security enabled. IBM and NVD sources describe a weakness where a WS‑Security/LTPA token handling flaw can allow a user to gain elevated privileges, potentially via identity reuse between inbound/outbound tokens. Affected versions inc...