IBM WebSphere Commerce Outbound Messaging System Information Disclosure Vulnerability

Bugtraq ID:	45292
Class:	Design Error
CVE:	CVE-2010-2639
Remote:	Yes
Local:	No
Published:	Dec 09 2010 12:00AM
Updated:	Dec 09 2010 12:00AM
Credit:	IBM
Vulnerable:	IBM WebSphere Commerce 7.0.0.1 IBM WebSphere Commerce 7.0
Not Vulnerable:	IBM WebSphere Commerce 7.0.0.2

IBM WebSphere Commerce Outbound Messaging System Information Disclosure Vulnerability

IBM WebSphere Commerce is prone to a remote information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information and read messages intended for other recipients, which may lead to further attacks.

IBM WebSphere Commerce versions prior to 7.0 Fix Pack 2 (7.0.0.2) are vulnerable.

IBM WebSphere Commerce Outbound Messaging System Information Disclosure Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM WebSphere Commerce Outbound Messaging System Information Disclosure Vulnerability

Solution:
IBM has released fixes. Please see the reference for more information.

IBM WebSphere Commerce Outbound Messaging System Information Disclosure Vulnerability

References:

• IBM Websphere Homepage (IBM)
  
• JR38114: CMVC 205725 - STOP RUNTIMEPROFILECACHECMDIMPL CACHING MUTABLE OBJECTS M (IBM)
  
• JR38114: Potential security exposure in the outbound messaging system (IBM)