CVE-2009-2743 json
IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27, and 7.0 before 7.0.0.7, does not properly handle an exception occurring after u…
published 2009-09-21 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-2733
- cvss
- 2.1
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 33%
- public exploits
- 0
- none known
Summary
IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27, and 7.0 before 7.0.0.7, does not properly handle an exception occurring after use of wsadmin scripts and configuration of JAAS-J2C Authentication Data, which allows local users to obtain sensitive information by reading the First Failure Data Capture (FFDC) log file.
Patch / fix
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
References
-
www-01.ibm.com
/support/docview.wss?uid=swg27007951
patch
-
www-1.ibm.com
/support/docview.wss?uid=swg1PK86137
vendor-advisory
-
secunia.com
/advisories/37796
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2009/2721
vdb-entry, vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/53343
vdb-entry
- www-01.ibm.com /support/docview.wss?uid=swg27014463
Sources
- CVE List CVE-2009-2743
- NVD CVE-2009-2743
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.