CVEvulnerability
CVE-2009-0508
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2009-03-16
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-200
Description
The Servlet Engine/Web Container and JSP components in IBM WebSphere Application Server (WAS) 5.1.0, 5.1.1.19, 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.23, and 7.0 before 7.0.0.3 allow remote attackers to read arbitrary files contained in war files in (1) web-inf, (2) meta-inf, and unspecified other directories via unknown vectors, related to (a) web-based applications and (b) the administrative console.
Affected configurations
• ibm websphere application server 5.1.0
• ibm websphere application server 5.1.1.19
• ibm websphere application server 6.0.2
• ibm websphere application server 6.0.2.1
• ibm websphere application server 6.0.2.3
• ibm websphere application server 6.0.2.5
• ibm websphere application server 6.0.2.7
• ibm websphere application server 6.0.2.9
• ibm websphere application server 6.0.2.11
• ibm websphere application server 6.0.2.15
• ibm websphere application server 6.0.2.17
• ibm websphere application server 6.0.2.19
• ibm websphere application server 6.0.2.21
• ibm websphere application server 6.0.2.23
• ibm websphere application server 6.0.2.25
• ibm websphere application server 6.0.2.27
• ibm websphere application server 6.0.2.29
• ibm websphere application server 6.0.2.31
• ibm websphere application server 6.0.2.33
• ibm websphere application server 6.1
• ibm websphere application server 6.1.0.1
• ibm websphere application server 6.1.0.2
• ibm websphere application server 6.1.0.3
• ibm websphere application server 6.1.0.5
• ibm websphere application server 6.1.0.7
• ibm websphere application server 6.1.0.9
• ibm websphere application server 6.1.0.11
• ibm websphere application server 6.1.0.13
• ibm websphere application server 6.1.0.15
• ibm websphere application server 6.1.0.17
• ibm websphere application server 6.1.0.19
• ibm websphere application server 6.1.0.21
• ibm websphere application server 7.0
• ibm websphere application server 7.0.0.1
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://secunia.com/advisories/34283 Vendor Advisory
- http://secunia.com/advisories/34876 Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg24022456 Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1PK81387 www-01.ibm.com
- http://www-01.ibm.com/support/docview.wss?uid=swg21380233 Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21380376 Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg27006876 Patch
- http://www.securityfocus.com/bid/34104 www.securityfocus.com
- http://www.vupen.com/english/advisories/2009/0704 Patch, Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1188 Patch, Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1464 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49085 exchange.xforce.ibmcloud.com
- http://secunia.com/advisories/34283 Vendor Advisory
- http://secunia.com/advisories/34876 Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg24022456 Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1PK81387 www-01.ibm.com
- http://www-01.ibm.com/support/docview.wss?uid=swg21380233 Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21380376 Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg27006876 Patch
- http://www.securityfocus.com/bid/34104 www.securityfocus.com
- http://www.vupen.com/english/advisories/2009/0704 Patch, Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1188 Patch, Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1464 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49085 exchange.xforce.ibmcloud.com