CVE-2009-0508
The Servlet Engine/Web Container and JSP components in IBM WebSphere Application Server (WAS) 5.1.0, 5.1.1.19, 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.23, and 7.0 before 7.0.0.3 allow remote attackers to read arbitrary files contained in war files in…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.92%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The Servlet Engine/Web Container and JSP components in IBM WebSphere Application Server (WAS) 5.1.0, 5.1.1.19, 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.23, and 7.0 before 7.0.0.3 allow remote attackers to read arbitrary files contained in war files in (1) web-inf, (2) meta-inf, and unspecified other directories via unknown vectors, related to (a) web-based applications and (b) the administrative console.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 2.92% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- ibm/websphere application server
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/34283Vendor Advisory
- http://secunia.com/advisories/34876Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg24022456Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1PK81387
- http://www-01.ibm.com/support/docview.wss?uid=swg21380233Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21380376Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg27006876Patch
- http://www.securityfocus.com/bid/34104
- http://www.vupen.com/english/advisories/2009/0704Patch, Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1188Patch, Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1464Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49085
- http://secunia.com/advisories/34283Vendor Advisory
- http://secunia.com/advisories/34876Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg24022456Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1PK81387
- http://www-01.ibm.com/support/docview.wss?uid=swg21380233Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21380376Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg27006876Patch
- http://www.securityfocus.com/bid/34104
- http://www.vupen.com/english/advisories/2009/0704Patch, Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1188Patch, Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1464Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49085
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.