CVE-2017-1577
HighSummary
IBM WebSphere Portal versions 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing 'dot dot' sequences (/../) to view arbitrary files on the system.
Risk Assessment
The risk to the organization is the potential for unauthorized access to sensitive files, which could lead to data exposure or further attacks on the system.
Recommendation
It is recommended to update IBM WebSphere Portal to the latest version and implement appropriate security measures to block access to unauthorized directories.
Other vulnerabilities in IBM WebSphere Portal
See all- CVE-2015-7428High
CVE-2015-7428 in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary websites.
- CVE-2015-7472High
IBM WebSphere Portal versions 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF20, and 8.5.0 before CF10 are vulnerable to LDAP injection attacks, allowing remote attackers to read or write to repository data.
- CVE-2015-7419High
IBM WebSphere Portal 8.0.0.1 before CF19 and 8.5.0 before CF09 is vulnerable to remote attacks that can cause denial of service through memory consumption via crafted requests.
- CVE-2015-1886High
The Remote Document Conversion Service (DCS) in IBM WebSphere Portal versions 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through CF05 allows remote attackers to cause a denial of service (memory consumption) via crafted requests.
Original NVD description (English source)
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 132117.