CVE-2008-4679

Опубликовано: 22 окт. 2008

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19, when Certificate Store Collections is configured to use Certificate Revocation Lists (CRL), does not call the setRevocationEnabled method on the PKIXBuilderParameters object, which prevents the "Java security method" from checking the revocation status of X.509 certificates and allows remote attackers to bypass intended access restrictions via a SOAP message with a revoked certificate.

Ссылки

http://secunia.com/advisories/32296
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg27006876
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg27007951
Patch
Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1PK61258
Patch
Vendor Advisory
http://www.securityfocus.com/bid/31839
http://www.vupen.com/english/advisories/2008/2871
https://exchange.xforce.ibmcloud.com/vulnerabilities/46002
http://secunia.com/advisories/32296
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg27006876
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg27007951
Patch
Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1PK61258
Patch
Vendor Advisory
http://www.securityfocus.com/bid/31839
http://www.vupen.com/english/advisories/2008/2871
https://exchange.xforce.ibmcloud.com/vulnerabilities/46002

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:websphere_application_server:6.0.1.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.1.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.1.3:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.1.5:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.1.7:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.1.9:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.1.11:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.1.13:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.1.15:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.1.17:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.2.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.2.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.2.3:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.2.4:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.2.5:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.2.6:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.2.9:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.2.11:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.2.13:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.2.15:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.2.17:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.2.19:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.2.23:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.2.25:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:6.0.2.27:*:*:*:*:*:*:*

EPSS

Процентиль: 53%

0.00302

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-287

Связанные уязвимости

GHSA-pcg9-cjxc-8j7x

github

больше 3 лет назад