CVE-2005-1112
IBM WebSphere Application Server 6.0 and earlier, when sharing the document root of the web server, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via an HTTP request with an invalid Host header, which causes the page to…
Does this matter?
Lower severity and a low EPSS score (8.64%). Track it; it rarely justifies an emergency change on its own.
Description
IBM WebSphere Application Server 6.0 and earlier, when sharing the document root of the web server, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via an HTTP request with an invalid Host header, which causes the page to be processed by the web server instead of the JSP engine.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 8.64% probability · 95th percentile
- CISA KEV
- Not listed
- Affected
- ibm/websphere application server
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=111342594129109&w=2
- http://secunia.com/advisories/14962Vendor Advisory
- http://securitytracker.com/id?1013697Vendor Advisory
- http://www.osvdb.org/15501
- http://www.securityfocus.com/bid/13160
- https://exchange.xforce.ibmcloud.com/vulnerabilities/20099
- http://marc.info/?l=bugtraq&m=111342594129109&w=2
- http://secunia.com/advisories/14962Vendor Advisory
- http://securitytracker.com/id?1013697Vendor Advisory
- http://www.osvdb.org/15501
- http://www.securityfocus.com/bid/13160
- https://exchange.xforce.ibmcloud.com/vulnerabilities/20099
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.