CVE-2013-2994

Published: Aug 1, 2013Modified: Apr 29, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 incorrectly maintains a valid session after unspecified interaction with REST services, which allows remote attackers to issue REST requests in the context of an arbitrary user's active session via unknown vectors.

Affected (2)

Products: Ibm: Websphere Commerce

1 product

Websphere Commerce

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Ibm Websphere Commerce	Version 7.0 feature_pack4
Ibm Websphere Commerce	Version 7.0 feature_pack5

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (6)

http://www-01.ibm.com/support/docview.wss?uid=swg1JR45420

Source: psirt@us.ibm.com

http://www-01.ibm.com/support/docview.wss?uid=swg21644393

Source: psirt@us.ibm.com

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/84033

Source: psirt@us.ibm.com

http://www-01.ibm.com/support/docview.wss?uid=swg1JR45420

Source: af854a3a-2127-422b-91ae-364da2661108

http://www-01.ibm.com/support/docview.wss?uid=swg21644393

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/84033

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.