CVE-2020-5016: Path Traversal
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. When application security is disabled and JAX-RPC applications are present, an attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary xml files on the system. This does not occur if Application security is enabled. IBM X-Force ID: 193556.
Other sources
IBM WebSphere Application Server could allow a remote attacker to traverse directories on the system. When application security is disabled and JAX-RPC applications are present, an attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary xml files on the system. This does not occur if Application security is enabled.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-5016?
CVE-2020-5016 has been assigned a medium severity level due to its potential for remote directory traversal.
How do I fix CVE-2020-5016?
To fix CVE-2020-5016, ensure application security is enabled and apply the latest patches from IBM for affected versions of WebSphere Application Server.
Which versions of IBM WebSphere Application Server are affected by CVE-2020-5016?
CVE-2020-5016 affects IBM WebSphere Application Server versions 7.0, 8.0, 8.5, and 9.0 up to specific release levels.
Can CVE-2020-5016 lead to unauthorized access?
Yes, CVE-2020-5016 can allow attackers to traverse directories, potentially leading to unauthorized access of sensitive files.
What can an attacker do with CVE-2020-5016?
An attacker exploiting CVE-2020-5016 could send specially-crafted URL requests to access restricted directories and files on the server.