Vulnerability in IBM Websphere Application Server

CVE-2011-1209

IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.39 and 7.0 before 7.0.0.17 uses a weak WS-Security XML encryption algorithm, which makes it easier for remote attackers to obtain plaintext data from a (1) JAX-RPC or (2) JAX-WS Web Services request via unspecified vectors related to a "decryption attack."

Vulnerability class: POODLE (CVE-2014-3566)

EPSS: 0.007 (48.3th percentile) — read the EPSS interpretation.

Affected products

Ibm Websphere_application_server — versions 6.1.0, 6.1.0.0, 6.1.0.1
N/a — versions n/a

Weakness classification (CWE)

CWE-310 — Cryptographic Issues

References

cve@mitre.org (vdb-entry, x_refsource_XF)
cve@mitre.org (vendor-advisory, x_refsource_AIXAPAR)
cve@mitre.org (x_refsource_CONFIRM, Patch)