CVE-2011-4889

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 does not properly update passwords on a configuration using Tivoli Directory Server, which might allow remote attackers to gain access to an application by leveraging knowledge of an old password. IBM X-Force ID: 72581.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-254

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/72581VDB Entry, Vendor Advisory
https://www-304.ibm.com/support/docview.wss?uid=swg21587015Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/72581VDB Entry, Vendor Advisory
https://www-304.ibm.com/support/docview.wss?uid=swg21587015Vendor Advisory

Timeline

Published: Feb 8, 2018
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-48904.0The server in IBM solidDB 6.5 before FP9 and 7.0 before FP1 allows remote authenticated users to cause a denial of service (daemon crash) vi CVE-2011-48944.3Tor before 0.2.2.34, when configured as a bridge, uses direct DirPort access instead of a Tor TLS connection for a directory fetch, which ma CVE-2011-48954.3Tor before 0.2.2.34, when configured as a bridge, sets up circuits through a process different from the process used by a client, which make CVE-2011-48964.3Tor before 0.2.2.24-alpha continues to use a reachable bridge that was previously configured but is not currently configured, which might al CVE-2011-48974.3Tor before 0.2.2.25-alpha, when configured as a relay without the Nickname configuration option, uses the local hostname as the Nickname val CVE-2011-48985.0wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacki CVE-2011-48997.5wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database ser CVE-2011-49006.5TYPO3 before 4.5.4 allows Information Disclosure in the backend.CVE-2011-49016.5TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 data CVE-2011-49026.5TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.CVE-2011-49036.1Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary we CVE-2011-49046.5TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve