Description
Multiple cross-site request forgery (CSRF) vulnerabilities in uddigui/navigateTree.do in the UDDI user console in IBM WebSphere Application Server (WAS) before 6.1.0 Fix Pack 13 (6.1.0.13) allow remote attackers to perform some actions as WAS UDDI users via the (1) keyField, (2) nameField, (3) valueField, and (4) frameReturn parameters.
References (6)
Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/26276
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27448
Various Sources vendor-advisory
x_refsource_aixapar
http://www-1.ibm.com/support/docview.wss?uid=swg1PK50245
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/38179
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/41619
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1018884
Scores
EPSS
0.0061
EPSS Percentile
45.2%
Details
CWE
CWE-352
Status
published
Products (1)
ibm/websphere_application_server
< 6.1.0.12
Published
Nov 03, 2007
Tracked Since
Feb 18, 2026