CVE-2009-0440

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-02-22 · updated 2026-06-16
Weakness: CWE-287

Description

IBM WebSphere Partner Gateway (WPG) 6.0.0 through 6.0.0.7 does not properly handle failures of signature verification, which might allow remote authenticated users to submit a crafted RosettaNet (aka RNIF) document to a backend application, related to (1) "altered service content" and (2) "digital signature foot-print."

Affected products

IBM Websphere Partner Gateway: 6.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.0.0.4, 6.0.0.5 (+2)

References

http://secunia.com/advisories/33994
http://www-01.ibm.com/support/docview.wss?uid=swg21330341
http://www-1.ibm.com/support/docview.wss?uid=swg1JR31231
http://www.securityfocus.com/bid/33839
https://exchange.xforce.ibmcloud.com/vulnerabilities/48530
http://secunia.com/advisories/33994
http://www-01.ibm.com/support/docview.wss?uid=swg21330341
http://www-1.ibm.com/support/docview.wss?uid=swg1JR31231
http://www.securityfocus.com/bid/33839
https://exchange.xforce.ibmcloud.com/vulnerabilities/48530

Get alerted when CVE-2009-0440 or the next vulnerability affects your stack