CVE-2009-1172

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-03-31 · updated 2026-06-16
Weakness: CWE-20

Description

The JAX-RPC WS-Security runtime in the Web Services Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3, when APAR PK41002 is installed, does not properly validate UsernameToken objects, which has unknown impact and attack vectors.

Affected products

IBM WebSphere Application Server: 6.1, 6.1.0, 6.1.0.0, 6.1.0.1, 6.1.0.2, 6.1.0.3 (+21)

References

http://secunia.com/advisories/34131
http://secunia.com/advisories/34461
http://www-01.ibm.com/support/docview.wss?uid=swg1PK75992
http://www-01.ibm.com/support/docview.wss?uid=swg21367223
http://www-01.ibm.com/support/docview.wss?uid=swg27007951
http://www-01.ibm.com/support/docview.wss?uid=swg27014463
http://www.securityfocus.com/bid/34502
http://secunia.com/advisories/34131
http://secunia.com/advisories/34461
http://www-01.ibm.com/support/docview.wss?uid=swg1PK75992
http://www-01.ibm.com/support/docview.wss?uid=swg21367223
http://www-01.ibm.com/support/docview.wss?uid=swg27007951

Get alerted when CVE-2009-1172 or the next vulnerability affects your stack