The Servlet Engine/Web Container and JSP components in IBM WebSphere Application Server (WAS) 5.1.0, 5.1.1.19, 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.23, and 7.0 before 7.0.0.3 allow remote attackers to read arbitrary files contained in war files in (1) web-inf, (2) meta-inf, and unspecified other directories via unknown vectors, related to (a) web-based applications and (b) the administrative console.
References
| Link | Resource |
|---|---|
| http://secunia.com/advisories/34283 | Vendor Advisory |
| http://secunia.com/advisories/34876 | Vendor Advisory |
| http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg24022456 | Patch Vendor Advisory |
| http://www-01.ibm.com/support/docview.wss?uid=swg1PK81387 | |
| http://www-01.ibm.com/support/docview.wss?uid=swg21380233 | Vendor Advisory |
| http://www-01.ibm.com/support/docview.wss?uid=swg21380376 | Patch Vendor Advisory |
| http://www-01.ibm.com/support/docview.wss?uid=swg27006876 | Patch |
| http://www.securityfocus.com/bid/34104 | |
| http://www.vupen.com/english/advisories/2009/0704 | Patch Vendor Advisory |
| http://www.vupen.com/english/advisories/2009/1188 | Patch Vendor Advisory |
| http://www.vupen.com/english/advisories/2009/1464 | Patch Vendor Advisory |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/49085 |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2009-03-16 19:30
Updated : 2024-02-28 11:21
NVD link : CVE-2009-0508
Mitre link : CVE-2009-0508
CVE.ORG link : CVE-2009-0508
JSON object : View
Products Affected
ibm
- websphere_application_server
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor