PT-2005-4294 · Ibm · Ibm Websphere Application Server

Published 2005-11-04 · Updated 2018-09-26 · CVE-2005-3498

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 5.0.x through 5.02.15 IBM WebSphere Application Server versions 5.1.x through 5.1.1.8 IBM WebSphere Application Server versions 6.x through V6.0.2.5

Description The issue allows attackers to obtain sensitive information when session trace is enabled and an application encodes a URL, as it records a full URL including the queryString in the trace logs.

Recommendations For IBM WebSphere Application Server versions 5.0.x through 5.02.15, update to version 5.02.15 or later. For IBM WebSphere Application Server versions 5.1.x through 5.1.1.8, update to version 5.1.1.8 or later. For IBM WebSphere Application Server versions 6.x through V6.0.2.5, update to fixpack V6.0.2.5 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2005-3498

Affected Products

Ibm Websphere Application Server

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/options.rb · Exploit
• http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27004980 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3498 · Security Note
• http://www-1.ibm.com/support/docview.wss?uid=swg24010781 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3498 · Note
• http://securitytracker.com/id?1015134 · Note
• http://vupen.com/english/advisories/2005/2291 · Note
• http://securityfocus.com/bid/15303 · Note