Description
IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 does not validate JSP includes, which allows remote attackers to obtain sensitive information, bypass intended request-dispatcher access restrictions, or cause a denial of service (memory consumption) via a crafted URL.
References (3)
Core 3
Core References
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21672572
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/92627
Various Sources vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1PI15723
Scores
EPSS
0.0131
EPSS Percentile
67.2%
Details
CWE
CWE-20
Status
published
Products (15)
ibm/websphere_portal
6.1.0.0
ibm/websphere_portal
6.1.0.1
ibm/websphere_portal
6.1.0.2
ibm/websphere_portal
6.1.0.3
ibm/websphere_portal
6.1.0.4
ibm/websphere_portal
6.1.0.5
ibm/websphere_portal
6.1.0.6 (2 CPE variants)
ibm/websphere_portal
6.1.5.0
ibm/websphere_portal
6.1.5.1
ibm/websphere_portal
6.1.5.2
... and 5 more
Published
May 22, 2014
Tracked Since
Feb 18, 2026