VULNERABILITY INTELLIGENCE
CVE-2009-2085
CVSS score7.5 HIGH
EPSS probability2.37%
CISA KEVNot currently listed
Published2009-08-13
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Description
The Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 does not properly handle use of Identity Assertion with CSIv2 Security, which allows remote attackers to bypass intended CSIv2 access restrictions via vectors involving Enterprise JavaBeans (EJB).
Weakness classification
- CWE-287: Improper Authentication