Description
IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository (JCR) information via a modified Web Content Manager (WCM) URL.
References
- 56161 third-party-advisory
- 20131227 SEC Consult SA-20131227-0 :: IBM Web Content Manager (WCM) XPath Injection mailing-list
- 64496 vdb-entry
- ibm-wsportal-cve20136735-jcr(89591) vdb-entry
- 101255 vdb-entry
- http://www-01.ibm.com/support/docview.wss?uid=swg21660289
- PI07777 vendor-advisory
- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_fix_available_for_unauthorized_information_retrieval_security_vulnerability_in_ibm_websphere_portal_cve_2013_6735
- 1029539 vdb-entry
- http://packetstormsecurity.com/files/124611/IBM-Web-Content-Manager-XPath-Injection.html