| Title | IBM WebSphere Application Server および WAS Feature Pack for Web Services における特権的アクセス権を取得される |
|---|---|
| Summary | IBM WebSphere Application Server (WAS) および WAS Feature Pack for Web Services の WS-Security の実装は、トラストストア (trust store) が XML デジタル署名用に設定されている場合、X.509 証明書を適切に検証しないため、特権的アクセス権を取得される脆弱性が存在します。 |
| Possible impacts | 第三者により、特権的アクセス権を取得される可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | Sept. 9, 2013, midnight |
| Registration Date | Sept. 24, 2013, 4:27 p.m. |
| Last Update | Sept. 24, 2013, 4:27 p.m. |
| CVSS2.0 : 警告 | |
| Score | 6.8 |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| IBM |
| IBM WebSphere Application Server 6.1.0.47 未満の 6.1 |
| IBM WebSphere Application Server 7.0.0.31 未満の 7.0 |
| IBM WebSphere Application Server 8.0.0.8 未満の 8.0 |
| IBM WebSphere Application Server 8.5.5.1 未満の 8.5 |
| IBM WebSphere Application Server Feature Pack for Web Services 6.1.0.47 未満の 6.1 |
| No | Changed Details | Date of change |
|---|---|---|
| 0 | [2013年09月24日] 掲載 |
Feb. 17, 2018, 10:37 a.m. |
| Summary | The WS-Security implementation in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1, and WAS Feature Pack for Web Services 6.1 before 6.1.0.47, when a trust store is configured for XML Digital Signatures, does not properly verify X.509 certificates, which allows remote attackers to obtain privileged access via unspecified vectors. |
|---|---|
| Publication Date | Sept. 21, 2013, 6:55 a.m. |
| Registration Date | Jan. 26, 2021, 3:42 p.m. |
| Last Update | Nov. 21, 2024, 10:54 a.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:ibm:websphere_application_server:8.5.0.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:8.5.5.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:8.5.0.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:8.5.0.0:*:*:*:*:*:*:* | |||||
| Configuration2 | or higher | or less | more than | less than | |
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.14:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.12:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.24:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.25:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.18:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.15:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.23:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.9:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.4:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.11:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.8:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.19:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.17:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.6:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.22:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.29:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.7:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.13:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.3:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.21:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.16:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.10:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:7.0.0.27:*:*:*:*:*:*:* | |||||
| Configuration3 | or higher | or less | more than | less than | |
| cpe:2.3:a:ibm:websphere_application_server:8.0.0.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:8.0.0.7:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:8.0.0.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:8.0.0.4:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:8.0.0.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:8.0.0.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:8.0.0.3:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:8.0.0.6:*:*:*:*:*:*:* | |||||
| Configuration4 | or higher | or less | more than | less than | |
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.21:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.31:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.19:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.33:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.25:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.11:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.41:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.39:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.14:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.43:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.9:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.27:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.29:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.7:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.3:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.17:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.13:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.15:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.23:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.35:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.45:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.37:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server:6.1.0.12:*:*:*:*:*:*:* | |||||
| Configuration5 | or higher | or less | more than | less than | |
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.47:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.43:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.37:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.41:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.21:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.11:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.35:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.17:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.45:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.31:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.15:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.23:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.29:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.33:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.25:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.19:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.27:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.39:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:ibm:websphere_application_server_feature_pack_for_web_services:6.1.0.13:*:*:*:*:*:*:* | |||||