VulnerabilityModified

CVE-2006-4223

MEDIUM 5.0EPSS 1.36%

Does this matter?

Lower severity and a low EPSS score (1.36%). Track it; it rarely justifies an emergency change on its own.

Description

IBM WebSphere Application Server (WAS) before 6.0.2.13 allows context-dependent attackers to obtain sensitive information via unspecified vectors related to "JSP source code exposure" (PK23475), which occurs when ibm-web-ext.xmi sets fileServingEnabled to true or ExtendedDocumentRoot is used to place a JSP outside a WAR.file; (3) the First Failure Data Capture (ffdc) log file (PK24834); and (4) traces (PK25568), a different issue than CVE-2006-4137.

CVSS 2.0: 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS: 1.36% probability · 70th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: ibm/websphere application server
Source: cve@mitre.org

References

http://secunia.com/advisories/21487Patch, Vendor Advisory
http://secunia.com/advisories/24478Vendor Advisory
http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27006876#60213
http://www-1.ibm.com/support/docview.wss?uid=swg21243541
http://www-1.ibm.com/support/docview.wss?uid=swg24013827
http://www.securityfocus.com/bid/22991
http://www.vupen.com/english/advisories/2006/3281Vendor Advisory
http://www.vupen.com/english/advisories/2007/0970Vendor Advisory
http://secunia.com/advisories/21487Patch, Vendor Advisory
http://secunia.com/advisories/24478Vendor Advisory
http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27006876#60213
http://www-1.ibm.com/support/docview.wss?uid=swg21243541
http://www-1.ibm.com/support/docview.wss?uid=swg24013827
http://www.securityfocus.com/bid/22991
http://www.vupen.com/english/advisories/2006/3281Vendor Advisory
http://www.vupen.com/english/advisories/2007/0970Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.