CVE-2009-1900

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-06-03 · updated 2026-06-16
Weakness: CWE-200

Description

The Configservice APIs in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.25, and 7.0 before 7.0.0.5, when tracing is enabled, allow remote attackers to obtain sensitive information via unspecified use of the wsadmin scripting tool.

Affected products

IBM WebSphere Application Server: through 6.0.2.33; 6.0.2, 6.0.2.1, 6.0.2.2, 6.0.2.3, 6.0.2.4, 6.0.2.5 (+26)

References

http://secunia.com/advisories/35301
http://www-01.ibm.com/support/docview.wss?uid=swg27006876
http://www-01.ibm.com/support/docview.wss?uid=swg27007951
http://www-01.ibm.com/support/docview.wss?uid=swg27014463
http://www-1.ibm.com/support/docview.wss?uid=swg1PK84999
http://www.securityfocus.com/bid/35405
http://www.vupen.com/english/advisories/2009/1464
https://exchange.xforce.ibmcloud.com/vulnerabilities/51171
https://exchange.xforce.ibmcloud.com/vulnerabilities/52077
http://secunia.com/advisories/35301
http://www-01.ibm.com/support/docview.wss?uid=swg27006876
http://www-01.ibm.com/support/docview.wss?uid=swg27007951

Get alerted when CVE-2009-1900 or the next vulnerability affects your stack