Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

IBM WebSphere Application Server lets authenticated users view data

CVE-2009-1899 · published 17 years ago
Summary

Versions of IBM WebSphere Application Server prior to the latest patches allow a user who has logged in to use the administrative wsadmin tool to read sensitive configuration information. This could expose details about your system that should remain private. Apply the IBM‑provided updates for the affected versions or restrict access to the wsadmin interface.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm websphere_application_server <= 6.0.2.33
6.0.2
6.0.2.1
6.0.2.2
6.0.2.3
6.0.2.4
6.0.2.5
6.0.2.6
6.0.2.7
6.0.2.8
6.0.2.9
6.0.2.10
21 more version ranges
cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*
Original advisory text
Unspecified vulnerability in the Administrative Configservice API in the System Management/Repository component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.25,...
Unspecified vulnerability in the Administrative Configservice API in the System Management/Repository component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.25, and 7.0 before 7.0.0.5 on z/OS allows remote authenticated users to obtain sensitive information via unknown use of the wsadmin scripting tool, related to a "security exposure in wsadmin."
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
4% chance of attack within 30 days
Timeline
Published3 Jun 2009
Updated25 Oct 2026
First seen29 Sep 2026
Sources
CVE-2009-1899 · NVD
Track software like this
Free during beta