CVE-2008-4284

MediumCVSS 5.8/10Last modified Jun 16, 2026

Description

Open redirect vulnerability in the ibm_security_logout servlet in IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.x versions, 6.0.x before 6.0.2.33, and 6.1.x before 6.1.0.23 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the logoutExitPage feature.

Metrics

CVSS 2.0 5.8/10AV:N/AC:M/Au:N/C:P/I:N/A:P

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www-1.ibm.com/support/docview.wss?uid=swg21320242Patch, Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg24021527Patch, Vendor Advisory
http://www.securityfocus.com/bid/33700
https://exchange.xforce.ibmcloud.com/vulnerabilities/47200
http://www-1.ibm.com/support/docview.wss?uid=swg21320242Patch, Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg24021527Patch, Vendor Advisory
http://www.securityfocus.com/bid/33700
https://exchange.xforce.ibmcloud.com/vulnerabilities/47200

Timeline

Published: Feb 10, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-42855.0Unspecified vulnerability in the Performance Monitoring Infrastructure (PMI) feature in the Servlet Engine/Web Container component in IBM We CVE-2008-429210.0Opera before 9.52 does not check the CRL override upon encountering a certificate that lacks a CRL, which has unknown impact and attack vect CVE-2008-429310.0Unspecified vulnerability in Opera before 9.52 on Windows, when registered as a protocol handler, allows remote attackers to cause a denial CVE-2008-42947.2IBM Tivoli Netcool/Webtop 2.1 before 2.1.0.5 preserves cached user privileges after logout, which allows physically proximate attackers to h CVE-2008-42955.4Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to establish a Bluetooth co CVE-2008-429610.0The Cisco Linksys WRT350N with firmware 1.0.3.7 has "admin" as its default password for the "admin" account, which makes it easier for remot CVE-2008-42975.0Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to r CVE-2008-42985.0Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (CVE-2008-42995.0A certain ActiveX control in the Microsoft Internet Authentication Service (IAS) Helper COM Component in iashlpr.dll allows remote attackers CVE-2008-43005.0A certain ActiveX control in adsiis.dll in Microsoft Internet Information Services (IIS) allows remote attackers to cause a denial of servic CVE-2008-430110.0A certain ActiveX control in iisext.dll in Microsoft Internet Information Services (IIS) allows remote attackers to set a password via a str CVE-2008-43025.5fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_to_page_cache_lru func