Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

IBM WebSphere Application Server may let attackers skip login

CVE-2009-2088 · published 17 years ago
Summary

Versions of IBM WebSphere Application Server 6.1 (before 6.1.0.25) and 7.0 (before 7.0.0.5) can be tricked into granting access to protected pages when certain single sign‑on and filter settings are used. This lets a remote user reach a secure URL without proper authentication. Apply the latest IBM fix or update to a supported version to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm websphere_application_server 6.1
6.1.0
6.1.0.0
6.1.0.1
6.1.0.2
6.1.0.3
6.1.0.4
6.1.0.5
6.1.0.6
6.1.0.7
6.1.0.8
6.1.0.9
19 more version ranges
cpe:2.3:a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:*
Original advisory text
The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when SPNEGO Single Sign-on (SSO) and disableSecurityPreInvokeOnFilte...
The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when SPNEGO Single Sign-on (SSO) and disableSecurityPreInvokeOnFilters are configured, allows remote attackers to bypass authentication via a request for a "secure URL," related to a certain invokefilterscompatibility property.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published13 Aug 2009
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2009-2088 · NVD
Track software like this
Free during beta