CVE-2013-4053

The WS-Security implementation in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1, and WAS Feature Pack for Web Services 6.1 before 6.1.0.47, when a trust store is configured for XML Digital Signatures, does not properly verify X.509 certificates, which allows remote attackers to obtain privileged access via unspecified vectors.

Score

CVSS 2.0 6.8 Medium

Status

Modified - psirt@us.ibm.com

Published

2013-09-20

Last modified

2024-08-06

Weaknesses

CWE-20

Affected products

• Websphere Application Server (Ibm)
• Websphere Application Server Feature Pack For Web Services (Ibm)

References

• http://www-01.ibm.com/support/docview.wss?uid=swg1PM90949
• http://www-01.ibm.com/support/docview.wss?uid=swg1PM91521
• http://www.ibm.com/support/docview.wss?uid=swg21647522
• https://exchange.xforce.ibmcloud.com/vulnerabilities/86505