Unscored severity · published Sep 20, 2011
CVE-2011-3577
IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.3 does not properly implement Activity Token authentication for Web Services, which has unspecified impact and…
–
CVSS
2%
EPSS
No
On KEV
Description
IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.3 does not properly implement Activity Token authentication for Web Services, which has unspecified impact and attack vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WC
Websphere Commerce · Ibm
6.0.0.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.0.4; 6.0.0.5; +10 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-3577
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-3577
Vendor Advisory
http://secunia.com/advisories/45999
www.ibm.com
http://www.ibm.com/support/docview.wss?uid=swg1JR40420
www.ibm.com
http://www.ibm.com/support/docview.wss?uid=swg24030908
www.osvdb.org
http://www.osvdb.org/75428
www.securityfocus.com
http://www.securityfocus.com/bid/49643
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/69838
More from Websphere Commerce
9.8
CVE-2016-6090
IBM WebSphere Commerce contains an unspecified vulnerability that could allow disclosure of user personal data, performing of unauthorized administrative operations, and…
8.8
CVE-2018-1808
IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control
8.8
CVE-2015-5007
Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 through 7.0.0.9, and 7.0 Feature Pack 8 allows remote authenticated users to…
8.0
CVE-2016-2863
Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 7.0 Feature Pack 8, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.0.1.2 allows remote authenticated users…
7.5
CVE-2017-1569
IBM WebSphere Commerce 7.0 and 8.0 contains an unspecified vulnerability in Marketing ESpot's that could cause a denial of service