CVE-2000-0652

IBM WebSphere Application Server - Unauthenticated Source Code Disclosure via InvokerServlet

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2000-0652. PoCs published by Shreeraj Shah.

AI-analyzed exploit summary The vulnerability in IBM WebSphere allows attackers to view the source code of files in the web document root by appending '/servlet/file/' to the URL, bypassing parsing/compilation. This is due to a flaw in the default servlet handling.

Description

IBM WebSphere allows remote attackers to read source code for executable web files by directly calling the default InvokerServlet using a URL which contains the "/servlet/file" string.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Shreeraj Shah · textremotemultiple
https://www.exploit-db.com/exploits/20097

The vulnerability in IBM WebSphere allows attackers to view the source code of files in the web document root by appending '/servlet/file/' to the URL, bypassing parsing/compilation. This is due to a flaw in the default servlet handling.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: IBM WebSphere Application Server
No auth needed
Prerequisites: Access to the target WebSphere server
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Patch, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/1500
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/5012
Exploit, Patch, Vendor Advisory mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2000-07/0342.html

Scores

EPSS 0.0783
EPSS Percentile 94.0%

Details

Status published
Products (3)
ibm/websphere_application_server 2.0
ibm/websphere_application_server 3.0
ibm/websphere_application_server 3.0.21
Published Jul 24, 2000
Tracked Since Feb 18, 2026