CVE-2011-1377 Security feature bypass in n/a

Critical 10.0 Published 15 Jan 2012 Updated 6 Aug 2024

Improper handling of WS-Security enabling in IBM WebSphere allows bypassing security features, requiring an upgrade to the latest feature pack.

Exploited in the wild: Not known
Login needed: Not stated
Attackable: Over the internet
Victim action needed: Not stated
Fix: None listed

What is CVE-2011-1377?

CVE-2011-1377 is a critical vulnerability in Ibm Websphere Application Server, published on 15 Jan 2012. It can be exploited over the network.

Official description

The Web Services Security component in the Web Services Feature Pack before 6.1.0.41 for IBM WebSphere Application Server (WAS) 6.1 does not properly handle the enabling of WS-Security for a JAX-WS application, which has unspecified impact and attack vectors.

Which versions are affected by CVE-2011-1377?

It affects 1 product.

Products include Ibm Websphere Application Server.

How do I fix CVE-2011-1377?

No fix has been published for CVE-2011-1377 yet. Limit exposure of the affected software until one is available.

Is CVE-2011-1377 being exploited?

There is no known exploitation of CVE-2011-1377 in the wild and no public exploit code.

All Ibm Websphere Application Server vulnerabilities

Sources

Also known as GHSA-hfwj-43j6-7v2f.