CVE-2011-4889

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 does not properly update passwords on a configuration using Tivoli Directory Server, which might allow remote attackers to gain access to an application by leveraging knowledge of an old password. IBM X-Force ID: 72581.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-254

Affected software

No affected versions have been published.

Timeline

Published
Feb 8, 2018
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2011

CVE-2011-48904.0The server in IBM solidDB 6.5 before FP9 and 7.0 before FP1 allows remote authenticated users to cause a denial of service (daemon crash) viCVE-2011-48944.3Tor before 0.2.2.34, when configured as a bridge, uses direct DirPort access instead of a Tor TLS connection for a directory fetch, which maCVE-2011-48954.3Tor before 0.2.2.34, when configured as a bridge, sets up circuits through a process different from the process used by a client, which makeCVE-2011-48964.3Tor before 0.2.2.24-alpha continues to use a reachable bridge that was previously configured but is not currently configured, which might alCVE-2011-48974.3Tor before 0.2.2.25-alpha, when configured as a relay without the Nickname configuration option, uses the local hostname as the Nickname valCVE-2011-48985.0wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lackiCVE-2011-48997.5wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database serCVE-2011-49006.5TYPO3 before 4.5.4 allows Information Disclosure in the backend.CVE-2011-49016.5TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 dataCVE-2011-49026.5TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.CVE-2011-49036.1Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary weCVE-2011-49046.5TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve