CVE-2010-1651

Severity: low (CVSS 1.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-05-03 · updated 2026-06-16
Weakness: CWE-310

Description

IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.31 and 7.0.x before 7.0.0.11, when Basic authentication and SIP tracing (aka full trace logging for SIP) are enabled, logs the entirety of all inbound and outbound SIP messages, which allows local users to obtain sensitive information by reading the trace log.

Affected products

IBM WebSphere Application Server: 6.1, 6.1.0, 6.1.0.0, 6.1.0.1, 6.1.0.2, 6.1.0.3 (+38)

References

http://secunia.com/advisories/39628
http://secunia.com/advisories/40096
http://www-01.ibm.com/support/docview.wss?uid=swg1PM08892
http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247
http://www-01.ibm.com/support/docview.wss?uid=swg1PM15829
http://www.osvdb.org/65437
http://www.vupen.com/english/advisories/2010/1411
https://exchange.xforce.ibmcloud.com/vulnerabilities/58324
http://secunia.com/advisories/39628
http://secunia.com/advisories/40096
http://www-01.ibm.com/support/docview.wss?uid=swg1PM08892
http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247

Get alerted when CVE-2010-1651 or the next vulnerability affects your stack