Directory traversal vulnerability in the administration console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41, 7.0 before 7.0.0.19, and 8.0 before 8.0.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

IBM WebSphere Application Server 6.1 before Fix Pack 41 appears to be running on the remote host.  As such, it is potentially affected by the following vulnerabilities :

  - A cross-site scripting vulnerability via vectors     related to web messaging. (CVE-2011-5065)

  - A cross-site scripting vulnerability in the Installation     Verification Test (IVT) in the Install component.
    (CVE-2011-1362)

  - The SibRaRecoverableSiXaResource class in the Default     Messaging Component does not properly handle a Service     Integration Bus (SIB) dump operation involving the     Failure Data Capture (FFDC) introspection code.  This     can allow local users to obtain sensitive information by     reading the FFDC log file. (CVE-2011-5066)

  - A directory traversal vulnerability in the     administration console that allows remote attackers to     read arbitrary files on the host. (CVE-2011-1359)

  - A potential Denial of Service with malicious range     requests. (CVE-2011-3192)

  - An unspecified vulnerability in the Web Services     Security component when enabling WS-Security for a     JAX-WS application. (CVE-2011-1377)

IBM WebSphere Application Server 8.0 before Fix Pack 1 appears to be running on the remote host and is potentially affected by the following vulnerabilities :

  - An open redirect vulnerability exists related to the     'logoutExitPage' parameter. This can allow remote     attackers to trick users into requesting unintended     URLs. (PM35701)

  - The administrative console can display a stack trace     under unspecified circumstances and can disclose     potentially sensitive information to local users.
    (PM36620)

  - An unspecified error exists that can allow cross-site     request forgery attacks. (PM36734)

  - A token verification error exists in the bundled     OpenSAML library. This error can allow an attacker to     bypass security controls with an XML signature wrapping     attack via SOAP messages. (PM43254)

  - A directory traversal attack is possible via unspecified     parameters in the 'help' servlet. (PM45322)

  - The JavaServer Faces (JSF) application functionality     could allow a remote attacker to read files because it     fails to properly handle requests. (PM45992)

  - The HTTP server contains an error in the 'ByteRange'     filter and can allow denial of service attacks when     processing malicious requests. (PM46234)

IBM WebSphere Application Server 7.0 before Fix Pack 19 appears to be running on the remote host.  As such, it is potentially affected by the following vulnerabilities :

  - An open redirect vulnerability exists related to the     'logoutExitPage' parameter. This can allow remote     attackers to trick users into requesting unintended     URLs. (PM35701)

  - The administrative console can display a stack trace     under unspecified circumstances and can disclose     potentially sensitive information to local users.
    (PM36620)

  - The Installation Verification Tool servlet (IVT) does     not properly sanitize user-supplied input of arbitrary     HTML and script code, which could allow cross-site     scripting attacks. (PM40733)

  - A token verification error exists in the bundled     OpenSAML library. This error can allow an attacker to     bypass security controls with an XML signature wrapping     attack via SOAP messages. (PM43254)

  - A directory traversal attack is possible via unspecified     parameters in the 'help' servlet. (PM45322)

ID	Name	Product	Family	Severity
57607	IBM WebSphere Application Server 6.1 < 6.1.0.41 Multiple Vulnerabilities	Nessus	Web Servers	critical
56348	IBM WebSphere Application Server 8.0 < Fix Pack 1 Multiple Vulnerabilities	Nessus	Web Servers	high
56229	IBM WebSphere Application Server 7.0 < Fix Pack 19 Multiple Vulnerabilities	Nessus	Web Servers	medium

Detections

Analytics

CVE-2011-1359

high

Tenable Plugins

critical

high

medium