CVE-2011-1311

IBM WebSphere Application Server < 7.0.0.15 - Authenticated Privilege Escalation via Security Role Mapping

Title source: llm
STIX 2.1

Description

The Security component in IBM WebSphere Application Server (WAS) before 7.0.0.15, when a J2EE 1.4 application is used, determines the security role mapping on the basis of the ibm-application-bnd.xml file instead of the intended ibm-application-bnd.xmi file, which might allow remote authenticated users to gain privileges in opportunistic circumstances by requesting a service.

References (2)

Core 2
Core References
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1PM25455
Various Sources x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg27014463

Scores

EPSS 0.0086
EPSS Percentile 54.7%

Details

CWE
CWE-264
Status published
Products (50)
ibm/websphere_application_server 2.0
ibm/websphere_application_server 3.0
ibm/websphere_application_server 3.0.2
ibm/websphere_application_server 3.0.2.1
ibm/websphere_application_server 3.0.2.2
ibm/websphere_application_server 3.0.2.3
ibm/websphere_application_server 3.0.2.4
ibm/websphere_application_server 3.0.21
ibm/websphere_application_server 3.5
ibm/websphere_application_server 3.5.1
... and 40 more
Published Mar 08, 2011
Tracked Since Feb 18, 2026