CVE-2013-6735
First published: Sun Dec 22 2013(Updated: )
IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository (JCR) information via a modified Web Content Manager (WCM) URL.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM WebSphere Portal | =6.0.0.0 | |
| IBM WebSphere Portal | =6.0.0.1 | |
| IBM WebSphere Portal | =6.0.1.0 | |
| IBM WebSphere Portal | =6.0.1.1 | |
| IBM WebSphere Portal | =6.0.1.2 | |
| IBM WebSphere Portal | =6.0.1.3 | |
| IBM WebSphere Portal | =6.0.1.4 | |
| IBM WebSphere Portal | =6.0.1.5 | |
| IBM WebSphere Portal | =6.0.1.6 | |
| IBM WebSphere Portal | =6.0.1.7 | |
| IBM WebSphere Portal | =6.1.0.0 | |
| IBM WebSphere Portal | =6.1.0.1 | |
| IBM WebSphere Portal | =6.1.0.2 | |
| IBM WebSphere Portal | =6.1.0.3 | |
| IBM WebSphere Portal | =6.1.0.4 | |
| IBM WebSphere Portal | =6.1.0.5 | |
| IBM WebSphere Portal | =6.1.0.6 | |
| IBM WebSphere Portal | =6.1.5.0 | |
| IBM WebSphere Portal | =6.1.5.1 | |
| IBM WebSphere Portal | =6.1.5.2 | |
| IBM WebSphere Portal | =6.1.5.3 | |
| IBM WebSphere Portal | =7.0.0.0 | |
| IBM WebSphere Portal | =7.0.0.1 | |
| IBM WebSphere Portal | =7.0.0.2 | |
| IBM WebSphere Portal | =8.0.0.0 | |
| IBM WebSphere Portal | =8.0.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://osvdb.org/101255
- http://packetstormsecurity.com/files/124611/IBM-Web-Content-Manager-XPath-Injection.html
- http://secunia.com/advisories/56161
- http://www-01.ibm.com/support/docview.wss?uid=swg1PI07777
- http://www-01.ibm.com/support/docview.wss?uid=swg21660289
- http://www.securityfocus.com/archive/1/530552/100/0/threaded
- http://www.securityfocus.com/bid/64496
- http://www.securitytracker.com/id/1029539
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89591
- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_fix_available_for_unauthorized_information_retrieval_security_vulnerability_in_ibm_websphere_portal_cve_2013_6735
Frequently Asked Questions
What is the severity of CVE-2013-6735?
CVE-2013-6735 has a medium severity score due to the potential for remote attackers to access sensitive information.
How do I fix CVE-2013-6735?
To fix CVE-2013-6735, you should apply the latest security patches provided by IBM for your version of WebSphere Portal.
What versions of IBM WebSphere Portal are affected by CVE-2013-6735?
CVE-2013-6735 affects IBM WebSphere Portal versions 6.0.0.x through 8.0.0.1.
What are the potential risks of CVE-2013-6735?
The risks of CVE-2013-6735 include unauthorized access to sensitive Java Content Repository information.
Is there a workaround for CVE-2013-6735 if I cannot apply a patch immediately?
A potential workaround for CVE-2013-6735 is to restrict access to the affected components to trusted users only.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/remedy
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm websphere portal
- version/ibm websphere portal/6.0.0.0
- version/ibm websphere portal/6.0.0.1
- version/ibm websphere portal/6.0.1.0
- version/ibm websphere portal/6.0.1.1
- version/ibm websphere portal/6.0.1.2
- version/ibm websphere portal/6.0.1.3
- version/ibm websphere portal/6.0.1.4
- version/ibm websphere portal/6.0.1.5
- version/ibm websphere portal/6.0.1.6
- version/ibm websphere portal/6.0.1.7
- version/ibm websphere portal/6.1.0.0
- version/ibm websphere portal/6.1.0.1
- version/ibm websphere portal/6.1.0.2
- version/ibm websphere portal/6.1.0.3
- version/ibm websphere portal/6.1.0.4
- version/ibm websphere portal/6.1.0.5
- version/ibm websphere portal/6.1.0.6
- version/ibm websphere portal/6.1.5.0
- version/ibm websphere portal/6.1.5.1
- version/ibm websphere portal/6.1.5.2
- version/ibm websphere portal/6.1.5.3
- version/ibm websphere portal/7.0.0.0
- version/ibm websphere portal/7.0.0.1
- version/ibm websphere portal/7.0.0.2
- version/ibm websphere portal/8.0.0.0
- version/ibm websphere portal/8.0.0.1