Read the docs
TI-2011-01682 Aliases CVE-2011-1906GHSA-ch7m-4fh6-r3f2

Trustwave WebDefend Enterprise before 5.0 7.01.903-1.4 stores specific user-account…

Priority LOW 25CWE-255Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Trustwave WebDefend Enterprise before 5.0 7.01.903-1.4 stores specific user-account credentials in a MySQL database, which makes it easier for remote attackers to read the event collection table via requests to the management port, a different vulnerability than CVE-2011-0756.

Why it matters now

EPSS 0.01064 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:h:trustwave:webdefend:*:*:enterprise:*:*:*:*:*up to 5.0VulnerableTrustwave
cpe:2.3:h:trustwave:webdefend:2.0:*:enterprise:*:*:*:*:*2.0VulnerableTrustwave
cpe:2.3:h:trustwave:webdefend:3.0:*:enterprise:*:*:*:*:*3.0VulnerableTrustwave
  • cpe:2.3:h:trustwave:webdefend:*:*:enterprise:*:*:*:*:* Versions up to 5.0 Vulnerable ·Trustwave
  • cpe:2.3:h:trustwave:webdefend:2.0:*:enterprise:*:*:*:*:* Versions 2.0 Vulnerable ·Trustwave
  • cpe:2.3:h:trustwave:webdefend:3.0:*:enterprise:*:*:*:*:* Versions 3.0 Vulnerable ·Trustwave

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-1906
  2. 2026-10-03 Alias added: GHSA-ch7m-4fh6-r3f2

References

Advisory 1

  • TI-2011-00659 The application server in Trustwave WebDefend Enterprise before 5.0 uses hardcoded… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences