Description
IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 incorrectly maintains a valid session after unspecified interaction with REST services, which allows remote attackers to issue REST requests in the context of an arbitrary user's active session via unknown vectors.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/84033
Various Sources vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1JR45420
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21644393
Scores
EPSS
0.0132
EPSS Percentile
67.4%
Details
CWE
CWE-20
Status
published
Products (1)
ibm/websphere_commerce
7.0 feature_pack4 (2 CPE variants)
Published
Aug 01, 2013
Tracked Since
Feb 18, 2026