CVEvulnerability
CVE-2013-0540
3.5 LOW
Official page ↗
- Status
- Modified
- Published
- 2013-04-24
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-287
Description
IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.0.2, when SSL is not enabled, does not properly validate authentication cookies, which allows remote authenticated users to bypass intended access restrictions via an HTTP session.
Affected configurations
• ibm websphere application server 8.5.0.0
• ibm websphere application server 8.5.0.1
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://www-01.ibm.com/support/docview.wss?&uid=swg21632423 Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1PM81056 www-01.ibm.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/82695 exchange.xforce.ibmcloud.com
- http://www-01.ibm.com/support/docview.wss?&uid=swg21632423 Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1PM81056 www-01.ibm.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/82695 exchange.xforce.ibmcloud.com