IBM WebSphere Commerce 7.0 before 7.0.0.6 when persistent sessions and personalization IDs are enabled allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors.