CVE-2011-1311: IBM WebSphere Application Server

Medium severity, CVSS 6.0. EPSS: 0.9% chance of exploitation in the next 30 days.

The Security component in IBM WebSphere Application Server (WAS) before 7.0.0.15, when a J2EE 1.4 application is used, determines the security role mapping on the basis of the ibm-application-bnd.xml file instead of the intended ibm-application-bnd.xmi file, which might allow remote authenticated users to gain privileges in opportunistic circumstances by requesting a service.

Affected products

• IBM WebSphere Application Server: up to and including 7.0.0.13; version 2.0 only; version 3.0 only; version 3.0.2 only; version 3.0.2.1 only; version 3.0.2.2 only; …

Published 2011-03-08. Last modified 2026-06-16.