CVE-2008-4679

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-08-06T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19, when Certificate Store Collections is configured to use Certificate Revocation Lists (CRL), does not call the setRevocationEnabled method on the PKIXBuilderParameters object, which prevents the \"Java security method\" from checking the revocation status of X.509 certificates and allows remote attackers to bypass intended access restrictions via a SOAP message with a revoked certificate."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-07T12:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27007951"}, {"name": "ADV-2008-2871", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2008/2871"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27006876"}, {"name": "PK61258", "tags": ["vendor-advisory", "x_refsource_AIXAPAR"], "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1PK61258"}, {"name": "32296", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/32296"}, {"name": "31839", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/31839"}, {"name": "websphere-crl-weak-security(46002)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46002"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-4679", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19, when Certificate Store Collections is configured to use Certificate Revocation Lists (CRL), does not call the setRevocationEnabled method on the PKIXBuilderParameters object, which prevents the \"Java security method\" from checking the revocation status of X.509 certificates and allows remote attackers to bypass intended access restrictions via a SOAP message with a revoked certificate."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www-01.ibm.com/support/docview.wss?uid=swg27007951", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27007951"}, {"name": "ADV-2008-2871", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2008/2871"}, {"name": "http://www-01.ibm.com/support/docview.wss?uid=swg27006876", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27006876"}, {"name": "PK61258", "refsource": "AIXAPAR", "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1PK61258"}, {"name": "32296", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/32296"}, {"name": "31839", "refsource": "BID", "url": "http://www.securityfocus.com/bid/31839"}, {"name": "websphere-crl-weak-security(46002)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46002"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T10:24:21.004Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27007951"}, {"name": "ADV-2008-2871", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2008/2871"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27006876"}, {"name": "PK61258", "tags": ["vendor-advisory", "x_refsource_AIXAPAR", "x_transferred"], "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1PK61258"}, {"name": "32296", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/32296"}, {"name": "31839", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/31839"}, {"name": "websphere-crl-weak-security(46002)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46002"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-4679", "datePublished": "2008-10-22T17:00:00.000Z", "dateReserved": "2008-10-22T00:00:00.000Z", "dateUpdated": "2024-08-07T10:24:21.004Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "4A754DD5-585B-4E89-9C01-2B47D2F5F6F2", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "D40DEF90-CE7F-46BB-A6FF-50C1797866B8", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "A5AAA544-D3F8-4AE2-BB2D-A64CB86EC988", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.5:*:*:*:*:*:*:*", "matchCriteriaId": "7C7D4ECD-8787-4F9B-B81C-C0DFD8DD20EC", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.7:*:*:*:*:*:*:*", "matchCriteriaId": "C43D3515-D9F5-4DC8-A030-9F97593495F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.9:*:*:*:*:*:*:*", "matchCriteriaId": "A1968803-FF03-477C-81FE-87528FC6DF6A", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.11:*:*:*:*:*:*:*", "matchCriteriaId": "62C1CA3B-E575-4531-A336-8BFC9F5DEC26", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.13:*:*:*:*:*:*:*", "matchCriteriaId": "6C130982-8C6E-413E-8296-C9C277FCBE6D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.15:*:*:*:*:*:*:*", "matchCriteriaId": "5E1790E4-073A-4666-80CB-4D967928A0BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.1.17:*:*:*:*:*:*:*", "matchCriteriaId": "6239EEAE-5852-4DF7-8627-87139BBB03B4", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "714C405D-1E8F-45C1-8A09-5103F0080C76", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "C7F31FD3-8681-4F07-9644-5CC87D512520", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "C2604E01-E43E-4882-8896-5E646E850286", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "458BAD79-958E-4665-B1F8-0D46E0C57045", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "0B68EE27-CC4F-4530-9DFE-D94171C45F64", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "AC1A723F-D685-4FE5-8938-5682A2D02155", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "810E5AEC-5C35-4962-B9BB-32D66290D1D2", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.9:*:*:*:*:*:*:*", "matchCriteriaId": "521DB050-3C94-49BF-8666-6EC2C358AA27", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.11:*:*:*:*:*:*:*", "matchCriteriaId": "DB4AB6BD-4439-4100-A3CE-4600AED10B65", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.13:*:*:*:*:*:*:*", "matchCriteriaId": "375DF4AF-3C7C-47C3-BBB8-AF2B3827AC13", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.15:*:*:*:*:*:*:*", "matchCriteriaId": "91CC2DA7-BAA6-4061-8D0C-81F002DEF06D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.17:*:*:*:*:*:*:*", "matchCriteriaId": "59BEDD70-B6DB-448F-A998-3E8774B0DB8C", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.19:*:*:*:*:*:*:*", "matchCriteriaId": "F200042C-D45E-4CAD-BF6E-E3DADF4D1D21", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.23:*:*:*:*:*:*:*", "matchCriteriaId": "EB622117-C91F-47D2-9832-B7DB340796E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.25:*:*:*:*:*:*:*", "matchCriteriaId": "6D87691D-0719-4447-B258-5FA2BD10F11A", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:websphere_application_server:6.0.2.27:*:*:*:*:*:*:*", "matchCriteriaId": "A5827DEC-ED8A-48D9-8C27-3B49D720E7B4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19, when Certificate Store Collections is configured to use Certificate Revocation Lists (CRL), does not call the setRevocationEnabled method on the PKIXBuilderParameters object, which prevents the \"Java security method\" from checking the revocation status of X.509 certificates and allows remote attackers to bypass intended access restrictions via a SOAP message with a revoked certificate."}, {"lang": "es", "value": "El componente Web Services Security en IBM WebSphere Application Server (WAS) v6.0.2 anterior a v6.0.2.31 y v6.1 anterior a v6.1.0.19, cuando el Certificate Store Collections est\u00e1 configurado para usar las Certificate Revocation Lists (CRL), no llama al m\u00e9todo setRevocationEnabled en el objeto PKIXBuilderParameters, que previene el \"Java security method\" desde la validaci\u00f3n del estado de revocaci\u00f3n de lso certificados X.509 y permite a atacantes remotos saltarse las restricciones de acceso establecidas a trav\u00e9s de un mensaje SOAP con un certificado revocado."}], "id": "CVE-2008-4679", "lastModified": "2026-06-16T22:58:17.867", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2008-10-22T18:00:00.973", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/32296"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27006876"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27007951"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1PK61258"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/31839"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2008/2871"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46002"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/32296"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27006876"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27007951"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1PK61258"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/31839"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2008/2871"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46002"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}