Vulnerability Description
The secure login page in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 does not redirect to an https page upon receiving an http request, which makes it easier for remote attackers to read the contents of WAS sessions by sniffing the network.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Websphere Application Server | <= 6.0.2.33 |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/35301Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg27006876Patch
- http://www-1.ibm.com/support/docview.wss?uid=swg1PK77010
- http://www.securityfocus.com/bid/35405
- http://www.vupen.com/english/advisories/2009/1464PatchVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51170
- http://secunia.com/advisories/35301Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg27006876Patch
- http://www-1.ibm.com/support/docview.wss?uid=swg1PK77010
- http://www.securityfocus.com/bid/35405
- http://www.vupen.com/english/advisories/2009/1464PatchVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51170
FAQ
What is CVE-2009-1898?
CVE-2009-1898 is a vulnerability with a CVSS score of 5.0 (MEDIUM). The secure login page in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 does not redirect to an https page upon receiving an http request, which m...
How severe is CVE-2009-1898?
CVE-2009-1898 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2009-1898?
Check the references section above for vendor advisories and patch information. Affected products include: Ibm Websphere Application Server.