Servers and applications
CVE-2009-0436 The (1) mod_ibm_ssl and (2) mod_cgid modules in IBM HTTP Server 6.0.x before 6.0.2.31 and 6.1.x before 6.1.0.19, as used in WebSphere Application Server (WAS), set incorrect permissions for AF_UNIX sockets, which has unknown impact and local attack vectors.
Severity High 7.2
Published 10 Feb 2009
Last changed 16 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 0.4% in the next 30 daysHigher than 31% of CVEs. EPSS by FIRST , 12 Nov 2026
Attack Needs local access · No login needed
Attacker can Read data · Change data · Take it down
CVSS vector AV:L/AC:L/Au:N/C:C/I:C/A:C
Sources NVD Affected software Software Affected versions IBM WebSphere Application ServerServers and applications · cpe:a:ibm:websphere_application_server Version 6.1.13 Version 6.1.0.18 Version 6.1.0.17 Version 6.1.0.16 All 57 release lines Version 6.0 Version 6.0.0.1 Version 6.0.0.2 Version 6.0.0.3 Version 6.0.1 Version 6.0.1.1 Version 6.0.1.2 Version 6.0.1.3 Version 6.0.1.5 Version 6.0.1.7 Version 6.0.1.9 Version 6.0.1.11 Version 6.0.1.13 Version 6.0.1.15 Version 6.0.1.17 Version 6.0.2 Version 6.0.2.1 Version 6.0.2.2 Version 6.0.2.3 Version 6.0.2.4 Version 6.0.2.5 Version 6.0.2.6 Version 6.0.2.7 Version 6.0.2.9 Version 6.0.2.11 Version 6.0.2.13 Version 6.0.2.15 Version 6.0.2.17 Version 6.0.2.19 Version 6.0.2.22 Version 6.0.2.23 Version 6.0.2.24 Version 6.0.2.25 Version 6.0.2.27 Version 6.0.2.28 Version 6.0.2.29 Version 6.0.2.30 Version 6.1 Version 6.1.0.1 Version 6.1.0.2 Version 6.1.0.3 Version 6.1.0.4 Version 6.1.0.5 Version 6.1.0.6 Version 6.1.0.7 Version 6.1.0.8 Version 6.1.0.9 Version 6.1.0.10 Version 6.1.0.11 Version 6.1.0.12 Version 6.1.0.13 Version 6.1.0.14 Version 6.1.0.15 Version 6.1.0.16 Version 6.1.0.17 Version 6.1.0.18 Version 6.1.13
References NVD https://nvd.nist.gov/vuln/detail/CVE-2009-0436 CVE.org https://www.cve.org/CVERecord?id=CVE-2009-0436