IBM FileNet Content Manager Cached Subject Security Bypass Vulnerability

Bugtraq ID:	35228
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jun 04 2009 12:00AM
Updated:	Jun 05 2009 03:39PM
Credit:	IBM
Vulnerable:	IBM FileNet P8 Platform 4.0.1 IBM FileNet P8 Platform 4.5 IBM FileNet P8 Platform 4.0
Not Vulnerable:

IBM FileNet Content Manager Cached Subject Security Bypass Vulnerability

IBM FileNet Content Manager is prone to a vulnerability that may allow attackers to bypass certain security restrictions.

This issue affects the following:

WebLogic Application Server â?? P8 Content Engine 4.0, 4.0.1, 4.5.0
WebSphere Application Server â?? P8 Content Engine 4.0, 4.0.1, 4.5.0

IBM FileNet Content Manager Cached Subject Security Bypass Vulnerability

Attackers can exploit this issue via a browser.

IBM FileNet Content Manager Cached Subject Security Bypass Vulnerability

Solution:
The vendor has released fixes and an advisory. Please see the references for details.

IBM FileNet Content Manager Cached Subject Security Bypass Vulnerability

References:

• FileNet Content Manager Homepage (IBM)
  
• IBM FileNet Content Manager authentication vulnerability with Web Services Exten (IBM)