CVE-2013-4053: The WS-Security implementation in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1, and WAS Feature Pack…

Unscored severity · published Sep 20, 2013

CVE-2013-4053

The WS-Security implementation in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1, and WAS Feature Pack…

–

CVSS

1.3%

EPSS

On KEV

Description

The WS-Security implementation in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1, and WAS Feature Pack for Web Services 6.1 before 6.1.0.47, when a trust store is configured for XML Digital Signatures, does not properly verify X.509 certificates, which allows remote attackers to obtain privileged access via unspecified vectors.

Exploitation

Is it being used?

Exploit prediction (EPSS)1.3% · higher than 69% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Websphere Application Server · Ibm

8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; 7.0; 7.0.0.1; +34 more · source: NVD

Websphere Application Server Feature Pack For Web Services · Ibm

6.1.0.11; 6.1.0.13; 6.1.0.15; 6.1.0.17; 6.1.0.19; 6.1.0.21; +13 more · source: NVD