PT-2005-4294 · Ibm · Ibm Websphere Application Server

Publicado 2005-11-04 · Atualizado 2018-09-26 · CVE-2005-3498

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 5.0.x through 5.02.15 IBM WebSphere Application Server versions 5.1.x through 5.1.1.8 IBM WebSphere Application Server versions 6.x through V6.0.2.5

Description The issue allows attackers to obtain sensitive information when session trace is enabled and an application encodes a URL, as it records a full URL including the queryString in the trace logs.

Recommendations For IBM WebSphere Application Server versions 5.0.x through 5.02.15, update to version 5.02.15 or later. For IBM WebSphere Application Server versions 5.1.x through 5.1.1.8, update to version 5.1.1.8 or later. For IBM WebSphere Application Server versions 6.x through V6.0.2.5, update to fixpack V6.0.2.5 or later.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2005-3498

Produtos afetados

Ibm Websphere Application Server

Referências · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/options.rb · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3498 · Nota
• http://securitytracker.com/id?1015134 · Nota
• http://vupen.com/english/advisories/2005/2291 · Nota
• http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27004980 · Aviso do Fabricante
• http://securityfocus.com/bid/15303 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3498 · Nota de Segurança
• http://www-1.ibm.com/support/docview.wss?uid=swg24010781 · Aviso do Fabricante