CVE-2009-2085

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-08-13 · updated 2026-06-16
Weakness: CWE-287

Description

The Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 does not properly handle use of Identity Assertion with CSIv2 Security, which allows remote attackers to bypass intended CSIv2 access restrictions via vectors involving Enterprise JavaBeans (EJB).

Affected products

IBM WebSphere Application Server: 6.1, 6.1.0, 6.1.0.0, 6.1.0.1, 6.1.0.2, 6.1.0.3 (+25)

References

http://www-01.ibm.com/support/docview.wss?uid=swg27007951
http://www-01.ibm.com/support/docview.wss?uid=swg27014463
http://www-1.ibm.com/support/docview.wss?uid=swg1PK83097
https://exchange.xforce.ibmcloud.com/vulnerabilities/52076
http://www-01.ibm.com/support/docview.wss?uid=swg27007951
http://www-01.ibm.com/support/docview.wss?uid=swg27014463
http://www-1.ibm.com/support/docview.wss?uid=swg1PK83097
https://exchange.xforce.ibmcloud.com/vulnerabilities/52076

Get alerted when CVE-2009-2085 or the next vulnerability affects your stack