IBM WebSphere Application Console Servlets Information Disclosure Vulnerability

Bugtraq ID:	45800
Class:	Access Validation Error
CVE:	CVE-2011-0316
Remote:	Yes
Local:	No
Published:	Dec 17 2010 12:00AM
Updated:	Jan 28 2011 11:20AM
Credit:	Reported by the vendor
Vulnerable:	IBM Websphere Application Server 7.0 3 IBM Websphere Application Server 7.0 .9 IBM Websphere Application Server 7.0 .8 IBM Websphere Application Server 7.0 .2 IBM Websphere Application Server 7.0 .13 IBM Websphere Application Server 7.0 .12 IBM Websphere Application Server 7.0 .11 IBM Websphere Application Server 7.0 .11 IBM Websphere Application Server 6.1 .9 IBM Websphere Application Server 6.1 .8 IBM Websphere Application Server 6.1 .7 IBM Websphere Application Server 6.1 .6 IBM Websphere Application Server 6.1 .5 IBM Websphere Application Server 6.1 .4 IBM Websphere Application Server 6.1 .33 IBM Websphere Application Server 6.1 .32 IBM Websphere Application Server 6.1 .3 IBM Websphere Application Server 6.1 .25 IBM Websphere Application Server 6.1 .23 IBM Websphere Application Server 6.1 .22 IBM Websphere Application Server 6.1 .21 IBM Websphere Application Server 6.1 .20 IBM Websphere Application Server 6.1 .2 IBM Websphere Application Server 6.1 .19 IBM Websphere Application Server 6.1 .18 IBM Websphere Application Server 6.1 .17 IBM Websphere Application Server 6.1 .15 IBM Websphere Application Server 6.1 .14 IBM Websphere Application Server 6.1 .13 IBM Websphere Application Server 6.1 .12 IBM Websphere Application Server 6.1 .11 IBM Websphere Application Server 6.1 .10 IBM Websphere Application Server 6.1 .1 IBM Websphere Application Server 6.1 IBM Websphere Application Server 7.0.0.7 IBM Websphere Application Server 7.0.0.6 IBM Websphere Application Server 7.0.0.5 IBM Websphere Application Server 7.0.0.4 IBM Websphere Application Server 7.0.0.13 IBM Websphere Application Server 7.0.0.1 IBM Websphere Application Server 7.0 IBM Websphere Application Server 7.0 IBM Websphere Application Server 6.1.0.34 IBM Websphere Application Server 6.1.0.33 IBM Websphere Application Server 6.1.0.33 IBM Websphere Application Server 6.1.0.31 IBM Websphere Application Server 6.1.0.29 IBM Websphere Application Server 6.1.0.27 IBM Websphere Application Server 6.1 IBM Tivoli Common Reporting 1.2
Not Vulnerable:	IBM Websphere Application Server 7.0.0.15 IBM Websphere Application Server 6.1.0.35 IBM Tivoli Common Reporting 1.2 Interim Fix 9

IBM WebSphere Application Console Servlets Information Disclosure Vulnerability

IBM WebSphere Application Server (WAS) is prone to an information-disclosure vulnerability.

Exploiting this issue may allow an attacker to access sensitive information that may aid in further attacks.

This issue affects WAS 6.1 before 6.1.0.35 and 7.0 before 7.0.0.15.

IBM WebSphere Application Console Servlets Information Disclosure Vulnerability

An attacker can exploit this issue through a browser.

IBM WebSphere Application Console Servlets Information Disclosure Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

IBM WebSphere Application Console Servlets Information Disclosure Vulnerability

References:

• Fix list for IBM WebSphere Application Server V6.1 (IBM)
  
• IBM Websphere Homepage (IBM)
  
• WebSphere Application Server console servlet information disclosure (IBM)
  
• WebSphere Application Server Web Container information disclosure (IBM)
  
• IBM Security Advisory - IY99978 (IBM)