CVE-2009-1898
The secure login page in the Administrative Console component in IBM WebSphere Application Server...
The secure login page in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 does not redirect to an https page upon receiving an http request, which makes it easier for remote attackers to read the contents of WAS sessions by sniffing the network.
Exploit likelihood
What each source reports
NVD Score used
The secure login page in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 does not redirect to an https page upon receiving an http request, which makes it easier for remote attackers to read the contents of WAS sessions by sniffing the network.
- Record
CVE-2009-1898- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The secure login page in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 does not redirect to an https page upon receiving an http request, which makes it easier for remote attackers to read the contents of WAS sessions by sniffing the network.
- Record
CVE-2009-1898- Updated
- 2026-11-02
EUVDEUVD-2009-1893 No score
The secure login page in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 does not redirect to an https page upon receiving an http request, which makes it easier for remote attackers to read the contents of WAS sessions by sniffing the network.
- Record
EUVD-2009-1893- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m28f-w6p6-jm6w No score
The secure login page in the Administrative Console component in IBM WebSphere Application Server...
The secure login page in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 does not redirect to an https page upon receiving an http request, which makes it easier for remote attackers to read the contents of WAS sessions by sniffing the network.
- Record
GHSA-m28f-w6p6-jm6w- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1898 is a medium vulnerability (CVSS 5.0) in Ibm Websphere Application Server, published June 3, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. No source names a fixed version.
References
secunia.com/advisories/35301
exchange.xforce.ibmcloud.com/vulnerabilities/51170
securityfocus.com/bid/35405
www-01.ibm.com/support/docview.wss?uid=swg27006876
www-1.ibm.com/support/docview.wss?uid=swg1PK77010
vupen.com/english/advisories/2009/1464
nvd.nist.gov/vuln/detail/CVE-2009-1898
github.com/advisories/GHSA-m28f-w6p6-jm6w