Vulnerability CVE-2009-0508 - CERT Civis.Net

Vulnerability Name:

CVE-2009-0508 (CCN-49085)

Assigned:

2009-03-12

Published:

2009-03-12

Updated:

2017-08-08

Summary:

The Servlet Engine/Web Container and JSP components in IBM WebSphere Application Server (WAS) 5.1.0, 5.1.1.19, 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.23, and 7.0 before 7.0.0.3 allow remote attackers to read arbitrary files contained in war files in (1) web-inf, (2) meta-inf, and unspecified other directories via unknown vectors, related to (a) web-based applications and (b) the administrative console.
Per: http://xforce.iss.net/xforce/xfdb/49085

CVSS score based on information provided by ISS.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2009-0508

Source: CCN
Type: SA34283
IBM WebSphere Application Server WAR File Information Disclosure

Source: SECUNIA
Type: Vendor Advisory
34283

Source: CCN
Type: SA34876
IBM Tivoli Workload Scheduler WebSphere Application Server Information Disclosure

Source: SECUNIA
Type: Vendor Advisory
34876

Source: CCN
Type: IBM Security Bulletin 1376806
Potential risk when using Web based applications on WebSphere Application Server (PK81387)

Source: CCN
Type: IBM APAR PK81387
7.0.0.1: Possible application source file exposure

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg24022456

Source: AIXAPAR
Type: UNKNOWN
PK81387

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21380233

Source: CCN
Type: IBM Support & downloads
WebSphere Application Server security exposures affect TWS eWAS

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21380376

Source: CONFIRM
Type: Patch
http://www-01.ibm.com/support/docview.wss?uid=swg27006876

Source: CCN
Type: OSVDB ID: 52620
IBM WebSphere Application Server (WAS) WAR File Handling Source Disclosure (PK81387)

Source: BID
Type: UNKNOWN
34104

Source: CCN
Type: BID-34104
IBM WebSphere Application Server WAR File Information Disclosure Vulnerability

Source: VUPEN
Type: Patch, Vendor Advisory
ADV-2009-0704

Source: VUPEN
Type: Patch, Vendor Advisory
ADV-2009-1188

Source: VUPEN
Type: Patch, Vendor Advisory
ADV-2009-1464

Source: XF
Type: UNKNOWN
websphere-web-app-security-bypass(49085)

Source: XF
Type: UNKNOWN
websphere-web-app-information-disclosure(49085)

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:websphere_application_server:5.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:5.1.1.19:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2.9:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2.11:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2.15:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2.17:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2.19:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2.21:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2.23:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2.25:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2.27:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2.29:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2.31:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.0.2.33:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.1.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.1.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.1.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.1.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.1.0.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.1.0.9:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.1.0.11:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.1.0.13:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.1.0.15:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.1.0.17:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.1.0.19:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.1.0.21:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0.0.1:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:ibm:websphere_application_server:6.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:5.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:*

Denotes that component is vulnerable