CVE-2013-6730

IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x before 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF10, when the wcm.path.traversal.security setting is enabled, allows remote attackers to bypass intended read restrictions on an item by accessing that item within search results.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg1PI07185
http://www-01.ibm.com/support/docview.wss?uid=swg21665915	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/89363

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:websphere_portal:6.1.0.0:::::::*
	cpe:2.3:a:ibm:websphere_portal:6.1.0.1:::::::*
	cpe:2.3:a:ibm:websphere_portal:6.1.0.2:::::::*
	cpe:2.3:a:ibm:websphere_portal:6.1.0.3:::::::*
	cpe:2.3:a:ibm:websphere_portal:6.1.0.4:::::::*
	cpe:2.3:a:ibm:websphere_portal:6.1.0.5:::::::*
	cpe:2.3:a:ibm:websphere_portal:6.1.0.6:::::::*
	cpe:2.3:a:ibm:websphere_portal:6.1.5.0:::::::*
	cpe:2.3:a:ibm:websphere_portal:6.1.5.1:::::::*
	cpe:2.3:a:ibm:websphere_portal:6.1.5.2:::::::*
	cpe:2.3:a:ibm:websphere_portal:6.1.5.3:::::::*
	cpe:2.3:a:ibm:websphere_portal:7.0.0.0:::::::*
	cpe:2.3:a:ibm:websphere_portal:7.0.0.1:::::::*
	cpe:2.3:a:ibm:websphere_portal:7.0.0.2:::::::*
	cpe:2.3:a:ibm:websphere_portal:8.0.0.0:::::::*
	cpe:2.3:a:ibm:websphere_portal:8.0.0.1:::::::*

History

No history.

Information

Published : 2014-03-04 22:55

Updated : 2024-02-28 12:20

NVD link : CVE-2013-6730

Mitre link : CVE-2013-6730

CVE.ORG link : CVE-2013-6730

JSON object : View

Products Affected

ibm

websphere_portal

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2013-6730", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-03-04T22:55:03.257", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI07185", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21665915", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89363", "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x before 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF10, when the wcm.path.traversal.security setting is enabled, allows remote attackers to bypass intended read restrictions on an item by accessing that item within search results."}, {"lang": "es", "value": "IBM WebSphere Portal 6.1.0.x hasta 6.1.0.6 CF27, 6.1.5.x hasta 6.1.5.3 CF27, 7.0.0.x anterior a 7.0.0.2 CF27 y 8.0.0.x anterior a 8.0.0.1 CF10, cuando la configuraci\u00f3n wcm.path.traversal.security est\u00e1 habilitada, permite a atacantes remotos evadir restricciones de lectura en un art\u00edculo mediante el acceso a este art\u00edculo dentro de los resultados de b\u00fasqueda."}], "lastModified": "2017-08-29T01:34:00.230", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:websphere_portal:6.1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E618064A-3D05-4DC6-9A47-0EDF2427642F"}, {"criteria": "cpe:2.3:a:ibm:websphere_portal:6.1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3DE74154-3E79-4D56-96C4-D8E644F1419D"}, {"criteria": "cpe:2.3:a:ibm:websphere_portal:6.1.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA915826-5D89-43E9-83E7-88973648302A"}, {"criteria": "cpe:2.3:a:ibm:websphere_portal:6.1.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5DB29F4-59AB-439C-91C4-CDF677676C26"}, {"criteria": "cpe:2.3:a:ibm:websphere_portal:6.1.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D6CA922-11EF-4315-A09A-B4A8937E4CF4"}, {"criteria": "cpe:2.3:a:ibm:websphere_portal:6.1.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "526738D7-1AF8-4A8F-B833-BA0E35973A3E"}, {"criteria": "cpe:2.3:a:ibm:websphere_portal:6.1.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13D6BE9C-16FD-4FB4-8A87-56B42C246316"}, {"criteria": "cpe:2.3:a:ibm:websphere_portal:6.1.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F1964FC-672F-4139-938F-A8EF9D86D9C2"}, {"criteria": "cpe:2.3:a:ibm:websphere_portal:6.1.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5B50CEA-AFC4-4B45-9954-519965237FC3"}, {"criteria": "cpe:2.3:a:ibm:websphere_portal:6.1.5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0902AC0F-EA4D-4E65-A70A-15DE9B904B35"}, {"criteria": "cpe:2.3:a:ibm:websphere_portal:6.1.5.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D808F95D-C6BD-43EB-B16C-66449977BCFE"}, {"criteria": "cpe:2.3:a:ibm:websphere_portal:7.0.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D303B0B9-CDAB-409B-AE44-512D4791C36F"}, {"criteria": "cpe:2.3:a:ibm:websphere_portal:7.0.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6ECEE98-B276-4ED6-AA5A-109EA57E9925"}, {"criteria": "cpe:2.3:a:ibm:websphere_portal:7.0.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E4FF84B-A17F-464B-A718-67C44D2C69BC"}, {"criteria": "cpe:2.3:a:ibm:websphere_portal:8.0.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C90EF7A4-8181-42C3-BB95-395D0DD94C14"}, {"criteria": "cpe:2.3:a:ibm:websphere_portal:8.0.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F40E0F5-B964-4BDC-828E-7571619F7C5B"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}