What’s Vulnerable › Vulnerabilities

CVE-2011-4889

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-02-08 · updated 2026-06-16
• Weakness: CWE-254

Description

The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 does not properly update passwords on a configuration using Tivoli Directory Server, which might allow remote attackers to gain access to an application by leveraging knowledge of an old password. IBM X-Force ID: 72581.

Affected products

• IBM WebSphere Application Server: from 6.1 before 6.1.0.43; from 7.0 before 7.0.0.21; from 8.0 before 8.0.0.2 — fixed in 6.1.0.43, 7.0.0.21, 8.0.0.2

How to fix

Upgrade to a fixed version: IBM WebSphere Application Server 6.1.0.43, 7.0.0.21, 8.0.0.2. Check the vendor advisory for mitigations.

References

• https://exchange.xforce.ibmcloud.com/vulnerabilities/72581
• https://www-304.ibm.com/support/docview.wss?uid=swg21587015
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72581
• https://www-304.ibm.com/support/docview.wss?uid=swg21587015

Get alerted when CVE-2011-4889 or the next vulnerability affects your stack