VIR Vulnerability Intelligence Relay

CVE-2012-3306

medium
Published 2012-09-25 · Modified 2026-04-29
CVSS v3
—
CVSS v2
6.8
VIR risk
6.8

Description

IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, when multi-domain support is configured, does not purge password data from the authentication cache, which has unspecified impact and remote attack vectors.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: psirt@us.ibm.com — http://www.ibm.com/support/docview.wss?uid=swg21611313

Application impact
VendorProductVersionsFixed
ibmwebsphere_application_server6.1.0
ibmwebsphere_application_server6.1.0.0
ibmwebsphere_application_server6.1.0.1
ibmwebsphere_application_server6.1.0.2
ibmwebsphere_application_server6.1.0.3
ibmwebsphere_application_server6.1.0.4
ibmwebsphere_application_server6.1.0.5
ibmwebsphere_application_server6.1.0.7
ibmwebsphere_application_server6.1.0.9
ibmwebsphere_application_server6.1.0.11
ibmwebsphere_application_server6.1.0.12
ibmwebsphere_application_server6.1.0.15
ibmwebsphere_application_server6.1.0.17
ibmwebsphere_application_server6.1.0.19
ibmwebsphere_application_server6.1.0.21
ibmwebsphere_application_server6.1.0.23
ibmwebsphere_application_server6.1.0.25
ibmwebsphere_application_server6.1.0.27
ibmwebsphere_application_server6.1.0.29
ibmwebsphere_application_server6.1.0.31
ibmwebsphere_application_server6.1.0.33
ibmwebsphere_application_server6.1.0.35
ibmwebsphere_application_server6.1.0.37
ibmwebsphere_application_server6.1.0.39
ibmwebsphere_application_server6.1.0.41
ibmwebsphere_application_server6.1.0.43
ibmwebsphere_application_server7.0.0.1
ibmwebsphere_application_server7.0.0.2
ibmwebsphere_application_server7.0.0.3
ibmwebsphere_application_server7.0.0.4
ibmwebsphere_application_server7.0.0.5
ibmwebsphere_application_server7.0.0.6
ibmwebsphere_application_server7.0.0.7
ibmwebsphere_application_server7.0.0.8
ibmwebsphere_application_server7.0.0.9
ibmwebsphere_application_server7.0.0.10
ibmwebsphere_application_server7.0.0.11
ibmwebsphere_application_server7.0.0.13
ibmwebsphere_application_server7.0.0.14
ibmwebsphere_application_server7.0.0.15
ibmwebsphere_application_server7.0.0.16
ibmwebsphere_application_server7.0.0.17
ibmwebsphere_application_server7.0.0.19
ibmwebsphere_application_server7.0.0.21
ibmwebsphere_application_server7.0.0.23
ibmwebsphere_application_server8.0.0.0
ibmwebsphere_application_server8.0.0.1
ibmwebsphere_application_server8.0.0.2
ibmwebsphere_application_server8.0.0.3
ibmwebsphere_application_server8.0.0.4
ibmwebsphere_application_server8.5.0.0

References

CWEs

CWE-255

Verify integrity in audit chain (admin only). AS-IS.