CVE-2009-0504

IBM WebSphere Application Server < 7.0 - Exposure of Sensitive Information via WSPolicy IDAssertion

Title source: llm
STIX 2.1

Description

WSPolicy in the Web Services component in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.1 does not properly recognize the IDAssertion.isUsed binding property, which allows local users to discover a password by reading a SOAP message.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/48700
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg27014463
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www-1.ibm.com/support/docview.wss?uid=swg1PK73573

Scores

EPSS 0.0035
EPSS Percentile 26.8%

Details

CWE
CWE-200
Status published
Products (1)
ibm/websphere_application_server < 7.0
Published Feb 17, 2009
Tracked Since Feb 18, 2026