CVE-2009-0504: IBM WebSphere Application Server

Low severity, CVSS 2.1. EPSS: 0.3% chance of exploitation in the next 30 days.

WSPolicy in the Web Services component in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.1 does not properly recognize the IDAssertion.isUsed binding property, which allows local users to discover a password by reading a SOAP message.

Affected products

• IBM WebSphere Application Server: up to and including 7.0

Published 2009-02-17. Last modified 2026-06-16.