CVE-2014-0954
IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 does not validate JSP includes, which allows remote attackers to obtain sensitive information, bypass intended…
Does this matter?
Lower severity and a low EPSS score (1.31%). Track it; it rarely justifies an emergency change on its own.
Description
IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 does not validate JSP includes, which allows remote attackers to obtain sensitive information, bypass intended request-dispatcher access restrictions, or cause a denial of service (memory consumption) via a crafted URL.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.31% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- ibm/websphere portal
- Source
- psirt@us.ibm.com
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1PI15723
- http://www-01.ibm.com/support/docview.wss?uid=swg21672572Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/92627
- http://www-01.ibm.com/support/docview.wss?uid=swg1PI15723
- http://www-01.ibm.com/support/docview.wss?uid=swg21672572Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/92627
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.