IBM WebSphere Application Server 'Requires SSL' Option Security Bypass Vulnerability

Bugtraq ID:	38122
Class:	Design Error
CVE:	CVE-2010-0563
Remote:	Yes
Local:	No
Published:	Feb 05 2010 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	IBM
Vulnerable:	IBM Websphere Application Server 7.0 3 IBM Websphere Application Server 7.0 .8 IBM Websphere Application Server 7.0.0.7 IBM Websphere Application Server 7.0.0.5 IBM Websphere Application Server 7.0.0.1 IBM Websphere Application Server 7.0
Not Vulnerable:

IBM WebSphere Application Server 'Requires SSL' Option Security Bypass Vulnerability

IBM WebSphere Application Server (WAS) is prone to a security-bypass vulnerability.

Successful exploits may allow attackers to bypass certain security restrictions, which may lead to other attacks.

This issue affects WAS 7.0 through 7.0.0.8.

IBM WebSphere Application Server 'Requires SSL' Option Security Bypass Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM WebSphere Application Server 'Requires SSL' Option Security Bypass Vulnerability

Solution:
The vendor has released updates. Please see the references for details.

IBM WebSphere Application Server 'Requires SSL' Option Security Bypass Vulnerability

References:

• IBM Websphere Homepage (IBM)
  
• Potential security exposure with WebSphere Application Server with "Requires SSL (IBM)