VulnerabilityModified

CVE-2012-4834

Directory traversal vulnerability in LayerLoader.jsp in the theme component in IBM WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF19 and 8.0 before CF03 allows remote attackers to read arbitrary files via a crafted URI.

MEDIUM 5.0EPSS 3.13%

Does this matter?

Lower severity and a low EPSS score (3.13%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS: 3.13% probability · 87th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: ibm/websphere portal
Source: psirt@us.ibm.com

References

http://secunia.com/advisories/51281Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PM76354Vendor Advisory
http://www.ibm.com/connections/blogs/PSIRT/entry/security_vulnerability_in_theme_component_for_websphere_portal_versions_7_0_0_x_and_8_0_cve2012_48344Patch, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg21617713Patch, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg24033155Patch, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/78914Third Party Advisory, VDB Entry
http://secunia.com/advisories/51281Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PM76354Vendor Advisory
http://www.ibm.com/connections/blogs/PSIRT/entry/security_vulnerability_in_theme_component_for_websphere_portal_versions_7_0_0_x_and_8_0_cve2012_48344Patch, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg21617713Patch, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg24033155Patch, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/78914Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.