IBM WebSphere Commerce Unspecified Information Disclosure Vulnerability

Bugtraq ID:	36151
Class:	Unknown
CVE:	CVE-2009-2094
Remote:	No
Local:	Yes
Published:	Aug 26 2009 12:00AM
Updated:	Aug 26 2009 06:02PM
Credit:	IBM
Vulnerable:	IBM WebSphere Commerce 6.0.0.7 IBM WebSphere Commerce 6.0.0.6 IBM WebSphere Commerce 6.0.0.5 IBM WebSphere Commerce 6.0.0.4 IBM WebSphere Commerce 6.0.0.3 IBM WebSphere Commerce 6.0.0.2 IBM WebSphere Commerce 6.0.0.1 IBM WebSphere Commerce 6.0.0.0
Not Vulnerable:	IBM WebSphere Commerce 6.0.0.8

IBM WebSphere Commerce Unspecified Information Disclosure Vulnerability

IBM WebSphere Commerce is prone to an unspecified information-disclosure vulnerability.

Attackers can exploit this issue to harvest sensitive information that may lead to further attacks, including brute-force attacks against user accounts.

Versions prior to IBM WebSphere Commerce 6.0.0.8 are vulnerable.

IBM WebSphere Commerce Unspecified Information Disclosure Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM WebSphere Commerce Unspecified Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for details.

IBM WebSphere Commerce Unspecified Information Disclosure Vulnerability

References:

• AIXAPAR:LI74286 (IBM)
  
• IBM WebSphere Commerce APARS (IBM)
  
• IBM Websphere Homepage (IBM)