PT-2018-4077 · Ibm · Ibm Websphere Portal

Published 2018-07-11 · Updated 2018-09-06 · CVE-2013-2951

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions 7.0.0.x through 8.0.0.x

Description The issue allows local users to obtain sensitive information by reading a trace file when tracing is enabled for the Selfcare Portlet (Profile Management). This is because passwords are written to the trace file.

Recommendations For versions 7.0.0.x through 8.0.0.x, consider disabling the tracing feature for the Selfcare Portlet (Profile Management) to prevent sensitive information from being written to the trace file. Restrict access to the trace file to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2013-2951

Affected Products

Ibm Websphere Portal

References · 4

• http://www-01.ibm.com/support/docview.wss?uid=swg21642097 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2951 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/83621 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2951 · Note