CVE-2009-2749
Feature Pack for Communications Enabled Applications (CEA) before 1.0.0.1 for IBM WebSphere...
Feature Pack for Communications Enabled Applications (CEA) before 1.0.0.1 for IBM WebSphere Application Server 7.0.0.7 uses predictable session values, which allows man-in-the-middle attackers to spoof a collaboration session by guessing the value.
Exploit likelihood
What each source reports
NVD Score used
Feature Pack for Communications Enabled Applications (CEA) before 1.0.0.1 for IBM WebSphere Application Server 7.0.0.7 uses predictable session values, which allows man-in-the-middle attackers to spoof a collaboration session by guessing the value.
- Record
CVE-2009-2749- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Feature Pack for Communications Enabled Applications (CEA) before 1.0.0.1 for IBM WebSphere Application Server 7.0.0.7 uses predictable session values, which allows man-in-the-middle attackers to spoof a collaboration session by guessing the value.
- Record
CVE-2009-2749- Updated
- 2026-11-02
EUVDEUVD-2009-2739 No score
Feature Pack for Communications Enabled Applications (CEA) before 1.0.0.1 for IBM WebSphere Application Server 7.0.0.7 uses predictable session values, which allows man-in-the-middle attackers to spoof a collaboration session by guessing the value.
- Record
EUVD-2009-2739- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-43w7-r28v-f9wx No score
Feature Pack for Communications Enabled Applications (CEA) before 1.0.0.1 for IBM WebSphere...
Feature Pack for Communications Enabled Applications (CEA) before 1.0.0.1 for IBM WebSphere Application Server 7.0.0.7 uses predictable session values, which allows man-in-the-middle attackers to spoof a collaboration session by guessing the value.
- Record
GHSA-43w7-r28v-f9wx- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2749 is a medium vulnerability (CVSS 6.4) in Ibm Communications Enabled Applications, published December 8, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.15%, the 67th percentile. No source names a fixed version.