CVE-2009-2088

The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when SPNEGO Single Sign-on…

published August 13, 2009

CVSS
—
EPSS
2%
Percentile
83.6
In the wild
Unconfirmed
What it is

The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when SPNEGO Single Sign-on (SSO) and disableSecurityPreInvokeOnFilters are configured, allows remote attackers to bypass authentication via a request for a "secure URL," related to a certain invokefilterscompatibility property.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02352 · 83.6th percentile
Published
2009-08-13T18:00Z
EPSS history
Timeline
  • 13 AUG 18:00Z
    The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when SPNEGO Single Sign-on…
    cvelistv5