CVE-2013-2994

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-08-01 · updated 2026-06-16
Weakness: CWE-20

Description

IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 incorrectly maintains a valid session after unspecified interaction with REST services, which allows remote attackers to issue REST requests in the context of an arbitrary user's active session via unknown vectors.

Affected products

IBM WebSphere Commerce Enterprise: 7.0-feature_pack4, 7.0-feature_pack5

References

http://www-01.ibm.com/support/docview.wss?uid=swg1JR45420
http://www-01.ibm.com/support/docview.wss?uid=swg21644393
https://exchange.xforce.ibmcloud.com/vulnerabilities/84033
http://www-01.ibm.com/support/docview.wss?uid=swg1JR45420
http://www-01.ibm.com/support/docview.wss?uid=swg21644393
https://exchange.xforce.ibmcloud.com/vulnerabilities/84033

Get alerted when CVE-2013-2994 or the next vulnerability affects your stack