CVE-2013-6730: Medium severity IBM WebSphere Portal vulnerability
IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x before 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF10, when the wcm.path.traversal.security setting is enabled, allows remote attackers to bypass intended read restrictions on an item by accessing that item within search results.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable/turn off the wcm.path.traversal.security setting if it is enabled to prevent remote attackers from bypassing intended read restrictions via item access in search results.
IBM WebSphere Portal wcm.path.traversal.security = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6730?
The severity of CVE-2013-6730 is classified as high due to its potential for unauthorized access to sensitive information.
How do I fix CVE-2013-6730?
To fix CVE-2013-6730, apply the relevant patches provided by IBM for your specific version of WebSphere Portal.
What versions of IBM WebSphere Portal are affected by CVE-2013-6730?
IBM WebSphere Portal versions 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x before 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF10 are affected by CVE-2013-6730.
What type of attack can exploit CVE-2013-6730?
CVE-2013-6730 can be exploited by remote attackers to bypass intended read restrictions on specific items within the IBM WebSphere Portal.
Is enabling the wcm.path.traversal.security setting safe from CVE-2013-6730?
Enabling the wcm.path.traversal.security setting does not fully protect against CVE-2013-6730, as it can still be bypassed by targeted attacks.