CVE-2009-0903

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3, and the Feature Pack for Web Services for WAS 6.1 before 6.1.0.25, when a WS-Security policy is established at the operation level, does not properly handle inbound requests that lack a SOAPAction or WS-Addressing Action, which allows remote attackers to bypass intended access restrictions via a crafted request to a JAX-WS application.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www-1.ibm.com/support/docview.wss?uid=swg1PK72138
http://www-1.ibm.com/support/docview.wss?uid=swg1PK81944Patch, Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1PK87767Patch, Vendor Advisory
http://www.securityfocus.com/bid/35594
https://exchange.xforce.ibmcloud.com/vulnerabilities/51293
http://www-1.ibm.com/support/docview.wss?uid=swg1PK72138
http://www-1.ibm.com/support/docview.wss?uid=swg1PK81944Patch, Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1PK87767Patch, Vendor Advisory
http://www.securityfocus.com/bid/35594
https://exchange.xforce.ibmcloud.com/vulnerabilities/51293

Timeline

Published: Jun 25, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-09046.4The IBM Stax XMLStreamWriter in the Web Services component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 does not properly p CVE-2009-09051.7IBM WebSphere MQ 6.0 before 6.0.2.8 and 7.0 before 7.0.1.0 does not properly handle long group names, which might allow local users to gain CVE-2009-09066.5The Service Component Architecture (SCA) feature pack for IBM WebSphere Application Server (WAS) SCA 1.0 before 1.0.0.3 allows remote authen CVE-2009-09086.4Unspecified vulnerability in the ACE shared folders implementation in the VMware Host Guest File System (HGFS) shared folders feature in VMw CVE-2009-09099.3Heap-based buffer overflow in the VNnc Codec in VMware Workstation 6.5.x before 6.5.2 build 156735, VMware Player 2.5.x before 2.5.2 build 1 CVE-2009-09106.8Heap-based buffer overflow in the VNnc Codec in VMware Workstation 6.5.x before 6.5.2 build 156735, VMware Player 2.5.x before 2.5.2 build 1 CVE-2009-09127.2perl-MDK-Common 1.1.11 and 1.1.24, 1.2.9 through 1.2.14, and possibly other versions, in Mandriva Linux does not properly handle strings whe CVE-2009-09134.7Unspecified vulnerability in the keysock kernel module in Solaris 10 and OpenSolaris builds snv_01 through snv_108 allows local users to cau CVE-2009-09149.3Opera before 9.64 allows remote attackers to execute arbitrary code via a crafted JPEG image that triggers memory corruption.CVE-2009-09156.8Opera before 9.64 allows remote attackers to conduct cross-domain scripting attacks via unspecified vectors related to plug-ins.CVE-2009-091610.0Unspecified vulnerability in Opera before 9.64 has unknown impact and attack vectors, related to a "moderately severe issue."CVE-2009-09174.3Cross-site scripting (XSS) vulnerability in DFLabs PTK 1.0.0 through 1.0.4 allows remote attackers to inject arbitrary web script or HTML by