The AuthCache purge implementation in the Security component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.37 and 7.x before 7.0.0.15 does not purge a user from the PlatformCredential cache, which might allow remote authenticated users to gain privileges by leveraging a group membership specified in an old RACF Object (aka RACO).
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Websphere_application_server | Ibm | 6.1.0 (including) | 6.1.0 (including) |
| Websphere_application_server | Ibm | 6.1.0.0 (including) | 6.1.0.0 (including) |
| Websphere_application_server | Ibm | 6.1.0.1 (including) | 6.1.0.1 (including) |
| Websphere_application_server | Ibm | 6.1.0.2 (including) | 6.1.0.2 (including) |
| Websphere_application_server | Ibm | 6.1.0.3 (including) | 6.1.0.3 (including) |
| Websphere_application_server | Ibm | 6.1.0.5 (including) | 6.1.0.5 (including) |
| Websphere_application_server | Ibm | 6.1.0.7 (including) | 6.1.0.7 (including) |
| Websphere_application_server | Ibm | 6.1.0.9 (including) | 6.1.0.9 (including) |
| Websphere_application_server | Ibm | 6.1.0.11 (including) | 6.1.0.11 (including) |
| Websphere_application_server | Ibm | 6.1.0.12 (including) | 6.1.0.12 (including) |
| Websphere_application_server | Ibm | 6.1.0.15 (including) | 6.1.0.15 (including) |
| Websphere_application_server | Ibm | 6.1.0.17 (including) | 6.1.0.17 (including) |
| Websphere_application_server | Ibm | 6.1.0.19 (including) | 6.1.0.19 (including) |
| Websphere_application_server | Ibm | 6.1.0.21 (including) | 6.1.0.21 (including) |
| Websphere_application_server | Ibm | 6.1.0.23 (including) | 6.1.0.23 (including) |
| Websphere_application_server | Ibm | 6.1.0.25 (including) | 6.1.0.25 (including) |
| Websphere_application_server | Ibm | 6.1.0.27 (including) | 6.1.0.27 (including) |
| Websphere_application_server | Ibm | 6.1.0.29 (including) | 6.1.0.29 (including) |
| Websphere_application_server | Ibm | 6.1.0.31 (including) | 6.1.0.31 (including) |
| Websphere_application_server | Ibm | 6.1.0.33 (including) | 6.1.0.33 (including) |
| Websphere_application_server | Ibm | 6.1.0.35 (including) | 6.1.0.35 (including) |