CVE-2010-0563

The Single Sign-on (SSO) functionality in IBM WebSphere Application Server (WAS) 7.0.0.0 through 7.0.0.8 does not recognize the Requires SSL configuration option, which might allow remote attackers to obtain sensitive information by sniffing network sessions that were expected to be encrypted.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2010-02-08

Last modified

2024-09-17

Weaknesses

CWE-200

Affected products

• Websphere Application Server (Ibm)

References

• http://secunia.com/advisories/38425
• http://securitytracker.com/id?1023551
• http://www-01.ibm.com/support/docview.wss?uid=swg21417839
• http://www-1.ibm.com/support/docview.wss?uid=swg1PM00610
• http://www.osvdb.org/62140
• http://www.securityfocus.com/bid/38122