Description
Feature Pack for Communications Enabled Applications (CEA) before 1.0.0.1 for IBM WebSphere Application Server 7.0.0.7 uses predictable session values, which allows man-in-the-middle attackers to spoof a collaboration session by guessing the value.
References
- PM00435 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg27017328
- 37392 vdb-entry
- ADV-2009-3598 vdb-entry
- was-fbcea-collaboration-spoofing(54494) vdb-entry