Auth bypass in IBM Websphere Commerce

CVE-2013-2993

IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.7 does not properly perform authentication for unspecified web services, which allows remote attackers to issue requests in the context of an arbitrary user's active session via unknown vectors.

Vulnerability class: Broken Authentication

EPSS: 0.012 (65.8th percentile) — read the EPSS interpretation.

Affected products

Ibm Websphere_commerce — versions 6.0.0.1, 6.0.0.2, 6.0.0.3
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

psirt@us.ibm.com (vendor-advisory, x_refsource_AIXAPAR)
psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
psirt@us.ibm.com (vdb-entry, x_refsource_XF)