IBM WebSphere Commerce Activity Token Authentication Unspecified Security Vulnerability

Bugtraq ID:	49643
Class:	Unknown
CVE:	CVE-2011-3577
Remote:	Yes
Local:	No
Published:	Sep 15 2011 12:00AM
Updated:	Mar 19 2015 07:35AM
Credit:	IBM
Vulnerable:	IBM WebSphere Commerce 6.0.0.9 IBM WebSphere Commerce 6.0.0.8 IBM WebSphere Commerce 6.0.0.7 IBM WebSphere Commerce 6.0.0.6 IBM WebSphere Commerce 6.0.0.5 IBM WebSphere Commerce 6.0.0.4 IBM WebSphere Commerce 6.0.0.3 IBM WebSphere Commerce 6.0.0.2 IBM WebSphere Commerce 6.0.0.10 IBM WebSphere Commerce 6.0.0.1 IBM WebSphere Commerce 6.0.0.0
Not Vulnerable:	IBM WebSphere Commerce 7.0.0.3 IBM WebSphere Commerce 6.0.0.11

IBM WebSphere Commerce Activity Token Authentication Unspecified Security Vulnerability

IBM WebSphere Commerce is prone to an unspecified vulnerability.

Very little is known about this issue or its effects at this time. We will update this BID as more information emerges.

Versions prior to WebSphere Commerce 6.0.0.11 and 7.0.0.3 are vulnerable.

IBM WebSphere Commerce Activity Token Authentication Unspecified Security Vulnerability

Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM WebSphere Commerce Activity Token Authentication Unspecified Security Vulnerability

Solution:
The vendor has released fixes. Please see the references for details.

IBM WebSphere Commerce Activity Token Authentication Unspecified Security Vulnerability

References:

• IBM Websphere Homepage (IBM)
  
• JR40420: Potential security vulnerability with Web Services using Activity Token (IBM)