FKIE_CVE-2010-3186

Vulnerability from fkie_nvd - Published: 2010-08-30 20:00 - Updated: 2026-06-16 23:22
Severity
Summary
IBM WebSphere Application Server (WAS) 7.x before 7.0.0.13, and WebSphere Application Server Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, when a JAX-WS application is used, does not properly handle an IncludeTimestamp setting in the WS-Security policy, which has unspecified impact and remote attack vectors.
References
cve@mitre.orghttp://osvdb.org/67570
cve@mitre.orghttp://secunia.com/advisories/41173Vendor Advisory
cve@mitre.orghttp://www-01.ibm.com/support/docview.wss?uid=swg1PM08360
cve@mitre.orghttp://www-01.ibm.com/support/docview.wss?uid=swg1PM16014
cve@mitre.orghttp://www-01.ibm.com/support/docview.wss?uid=swg21443736Vendor Advisory
cve@mitre.orghttp://www-01.ibm.com/support/docview.wss?uid=swg24027708Vendor Advisory
cve@mitre.orghttp://www-01.ibm.com/support/docview.wss?uid=swg24027709Vendor Advisory
cve@mitre.orghttp://www.vupen.com/english/advisories/2010/2215
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/61435
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/67570
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/41173Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg1PM08360
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg1PM16014
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg21443736Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg24027708Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg24027709Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2010/2215
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/61435
Impacted products
Vendor Product Version
ibm websphere_application_server 7.0
ibm websphere_application_server 7.0.0.1
ibm websphere_application_server 7.0.0.2
ibm websphere_application_server 7.0.0.3
ibm websphere_application_server 7.0.0.4
ibm websphere_application_server 7.0.0.5
ibm websphere_application_server 7.0.0.6
ibm websphere_application_server 7.0.0.7
ibm websphere_application_server 7.0.0.9
ibm websphere_application_server 7.0.0.10
ibm websphere_application_server 7.0.0.11
ibm websphere_application_server 6.1.0.9
ibm websphere_application_server 6.1.0.10
ibm websphere_application_server 6.1.0.11
ibm websphere_application_server 6.1.0.12
ibm websphere_application_server 6.1.0.13
ibm websphere_application_server 6.1.0.14
ibm websphere_application_server 6.1.0.15
ibm websphere_application_server 6.1.0.16
ibm websphere_application_server 6.1.0.17
ibm websphere_application_server 6.1.0.18
ibm websphere_application_server 6.1.0.19
ibm websphere_application_server 6.1.0.20
ibm websphere_application_server 6.1.0.21
ibm websphere_application_server 6.1.0.22
ibm websphere_application_server 6.1.0.23
ibm websphere_application_server 6.1.0.24
ibm websphere_application_server 6.1.0.25
ibm websphere_application_server 6.1.0.26
ibm websphere_application_server 6.1.0.27
ibm websphere_application_server 6.1.0.29
ibm websphere_application_server 6.1.0.31
ibm websphere_application_server 6.1.0.32
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0905C80-A1BA-49CD-90CA-9270ECC3940C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:7.0.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B108457A-50DC-4432-9E30-98ADBEBF2389",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:7.0.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A8FC820-48D5-4850-82F7-8DA4A18EFF51",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:7.0.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "0661F4A0-A520-4443-B19D-6885920ADFE5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:7.0.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "A553A6E7-64AA-41F2-9B92-4EC715C617B0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:7.0.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "9BFBDE57-3895-4841-B23C-06336A7016EB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:7.0.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF56870A-F9D3-4544-B63A-EFC2E82A1F7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:7.0.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "30B7A7B9-FCD1-4509-93CF-C5B736B04F4B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:7.0.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "90BA0923-4064-49D3-82A2-EEFC4B0F9A9C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:7.0.0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "6289CCB4-9A13-4BB5-B44E-7CA936DD8421",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:7.0.0.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "833256BB-E2A6-4FE9-BE4F-982578023E43",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6A4EC9D-98C2-40B0-BA40-4838FE8D1FF7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "D3A3ADFB-93E0-42E5-B31B-59F22EA4E3EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "7AF5BB33-4E78-4123-8093-EBEE2F2B5598",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3F4B8EA-9299-42C1-AAFB-831701ED2FA2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "A45B6F32-5DFF-4833-9F0F-89576724CF97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "13C8054A-8581-4936-AF94-291AE56EB4DE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "13CA9A59-DFE4-4566-8719-E6FA4720F06A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "026EBFCD-0BC1-404B-BC14-292F35BE667A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "A89DD1BF-4AB0-480D-9856-B1BEA73A4AAD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "B13D74F8-4321-48B3-A33E-FCCFA93013CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "49E119EF-B6A5-4B6C-B199-C64F62CA7CB2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "2043B836-3950-46A1-89E4-08985DEA0D33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "C9C8FA3D-9162-4D9B-8250-FAC93ED77A2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "5EE93B7F-3EB5-4BE4-BFAA-4AA30D15A76D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.23:*:*:*:*:*:*:*",
              "matchCriteriaId": "E06DE5D4-D3A5-4783-ACE0-A80808DB09C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.24:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B009FD6-9352-4329-B67A-8155FB379889",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.25:*:*:*:*:*:*:*",
              "matchCriteriaId": "ABBABA44-D18E-4329-9C2B-90828DAD468B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.26:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7C152D8-CF12-44D9-BDCE-336311BB4B95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.27:*:*:*:*:*:*:*",
              "matchCriteriaId": "BDBB08AC-52AD-4D5A-9E76-AFB283D5FE5C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.29:*:*:*:*:*:*:*",
              "matchCriteriaId": "335D5585-9587-4AD7-A18E-4A3706ABBAF7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "A80D58C4-3DCA-4A37-9626-6DC957CEBE90",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:websphere_application_server:6.1.0.32:*:*:*:*:*:*:*",
              "matchCriteriaId": "C55E6051-51C4-49A1-AB0E-108E9ACA8B49",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM WebSphere Application Server (WAS) 7.x before 7.0.0.13, and WebSphere Application Server Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, when a JAX-WS application is used, does not properly handle an IncludeTimestamp setting in the WS-Security policy, which has unspecified impact and remote attack vectors."
    },
    {
      "lang": "es",
      "value": "El servidor de aplicaciones IBM WebSphere (WAS) v7.x en versiones anteriores a la v7.0.0.13, y WebSphere Application Server Feature Pack para Web Services v6.1.0.9 hasta la v6.1.0.32, si se utiliza una aplicaci\u00f3n JAX-WS, no maneja apropiadamente una opci\u00f3n de configuraci\u00f3n IncludeTimestamp en la pol\u00edtica WS-Security, lo que tiene un impacto y vectores de ataque sin especificar."
    }
  ],
  "id": "CVE-2010-3186",
  "lastModified": "2026-06-16T23:22:19.830",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": true,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2010-08-30T20:00:02.873",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/67570"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/41173"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM08360"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM16014"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21443736"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24027708"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24027709"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2010/2215"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61435"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/67570"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/41173"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM08360"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM16014"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21443736"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24027708"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24027709"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2010/2215"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61435"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.