CVE-2009-0891

CVE-2009-0891 describes a session hijacking vulnerability in the Web Services Security component of IBM WebSphere Application Server versions 7.0 (prior to Fix Pack 1), 6.1 (prior to Fix Pack 23), and 6.0.2 (prior to Fix Pack 33). The flaw stems from improper enforcement of nonce and timestamp expiration values in WS-Security bindings, allowing remote authenticated users to exploit the weakness. The vulnerability has a CVSS score of 5.5, indicating a medium severity. It can be exploited by an authenticated attacker over the network with low attack complexity, potentially leading to partial confidentiality and integrity compromise. There is no evidence of active exploitation, nor is exploit code publicly available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness and attention.