Summaryinfo

A vulnerability was found in IBM WebSphere Commerce up to 7.0 Feature Pack 5. It has been classified as critical. Affected by this issue is some unknown functionality of the component REST Session Handler. The manipulation leads to input validation. This vulnerability is documented as CVE-2013-2994. There is not any exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in IBM WebSphere Commerce up to 7.0 Feature Pack 5 (Application Server Software). It has been rated as critical. This issue affects an unknown code block of the component REST Session Handler. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality. The summary by CVE is:

IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 incorrectly maintains a valid session after unspecified interaction with REST services, which allows remote attackers to issue REST requests in the context of an arbitrary user s active session via unknown vectors.

The weakness was released 07/26/2013 as swg21644393 as confirmed bulletin (Website). It is possible to read the advisory at www-01.ibm.com. The public release was coordinated with IBM. The identification of this vulnerability is CVE-2013-2994 since 04/12/2013. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at www-01.ibm.com. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at X-Force (84033), SecurityFocus (BID 61483†), OSVDB (95785†) and Secunia (SA54356†). Entry connected to this vulnerability is available at VDB-9792. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Application Server Software

Vendor

• IBM

Name

• WebSphere Commerce

Version

• 7.0 Feature Pack 5

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion