CVE-2015-1936

The administrative console in IBM WebSphere Application Server (WAS) 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter.

Score

CVSS 2.0 6.0 Medium

Status

Modified - psirt@us.ibm.com

Published

2015-07-14

Last modified

2024-08-06

Weaknesses

CWE-284

Affected products

• Websphere Application Server (Ibm)

References

• http://www-01.ibm.com/support/docview.wss?uid=swg1PI37230
• http://www-01.ibm.com/support/docview.wss?uid=swg21959083
• http://www.securityfocus.com/bid/75480