The Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allows remote attackers to obtain potentially sensitive information about environment variables and JAR versions via unspecified vectors.

The version of IBM WebSphere Portal on the remote host is affected by multiple vulnerabilities in the Unified Task List (UTL) portlet :

  - An unspecified open redirect vulnerability exists that     allows a remote attacker to perform a phishing attack     by enticing a user to click a malicious URL.
    (CVE-2014-3054)

  - A SQL injection vulnerability exists that allows a     remote attacker who is a trusted user to manipulate or     inject SQL queries into the back-end database.
    (CVE-2014-3055)

  - An information disclosure vulnerability exists that     allows remote attackers to view environment variables     and certain JAR files along with the versions.
    (CVE-2014-3056)

  - A cross-site scripting vulnerability exists that allows     a remote attacker to execute arbitrary code in a user's     browser. (CVE-2014-3057)

ID	Name	Product	Family	Severity
77542	IBM WebSphere Portal 7.0.0.x Unified Task List Portlet < 6.0.1 Multiple Vulnerabilities (PI18909)	Nessus	Windows	high
77541	IBM WebSphere Portal 8.0.0.x Unified Task List Portlet Multiple Vulnerabilities (PI18909)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2014-3056

medium

Tenable Plugins

high

high