VULNERABILITY INTELLIGENCE
CVE-2009-2747
CVSS score5 MEDIUM
EPSS probability1.93%
CISA KEVNot currently listed
Published2011-10-30
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:P/I:N/A:N
Description
The Java Naming and Directory Interface (JNDI) implementation in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 does not properly restrict access to UserRegistry object methods, which allows remote attackers to obtain sensitive information via a crafted method call.