CVE-2009-0904

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-07-05 · updated 2026-06-16
Weakness: CWE-264

Description

The IBM Stax XMLStreamWriter in the Web Services component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 does not properly process XML encoding, which allows remote attackers to bypass intended access restrictions and possibly modify data via "XML fuzzing attacks" sent through SOAP requests.

Affected products

IBM WebSphere Application Server: 6.1, 6.1.0, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.1.0.4 (+22)

References

http://www-01.ibm.com/support/docview.wss?uid=swg27007951
http://www-1.ibm.com/support/docview.wss?uid=swg1PK84015
http://www.securityfocus.com/bid/35741
https://exchange.xforce.ibmcloud.com/vulnerabilities/51490
http://www-01.ibm.com/support/docview.wss?uid=swg27007951
http://www-1.ibm.com/support/docview.wss?uid=swg1PK84015
http://www.securityfocus.com/bid/35741
https://exchange.xforce.ibmcloud.com/vulnerabilities/51490

Get alerted when CVE-2009-0904 or the next vulnerability affects your stack