CVE Database
/

CVE-2008-4679

Back to search

CVE-2008-4679

Published: Oct 22, 2008

Modified: Aug 7, 2024

PUBLISHED

Description

The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19, when Certificate Store Collections is configured to use Certificate Revocation Lists (CRL), does not call the setRevocationEnabled method on the PKIXBuilderParameters object, which prevents the "Java security method" from checking the revocation status of X.509 certificates and allows remote attackers to bypass intended access restrictions via a SOAP message with a revoked certificate.

VendorProductVersions

n/a

n/a

affected
n/a

References

ADV-2008-2871
vdb-entry
x_refsource_VUPEN
PK61258
vendor-advisory
x_refsource_AIXAPAR
32296
third-party-advisory
x_refsource_SECUNIA
31839
vdb-entry
x_refsource_BID
websphere-crl-weak-security(46002)
vdb-entry
x_refsource_XF

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now