IBM WebSphere Service Registry and Repository Multiple Directory Traversal Vulnerabilities

Bugtraq ID:	71897
Class:	Input Validation Error
CVE:	CVE-2014-6155
Remote:	Yes
Local:	No
Published:	Dec 19 2014 12:00AM
Updated:	Dec 19 2014 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	IBM WebSphere Service Registry and Repository 8.5 IBM WebSphere Service Registry and Repository 7.5.0.4 IBM WebSphere Service Registry and Repository 7.5.0.3 IBM WebSphere Service Registry and Repository 7.5.0.2 IBM WebSphere Service Registry and Repository 7.5.0.1 IBM WebSphere Service Registry and Repository 7.5
Not Vulnerable:

IBM WebSphere Service Registry and Repository Multiple Directory Traversal Vulnerabilities

IBM WebSphere Service Registry and Repository is prone to multiple directory-traversal vulnerabilities.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to access or read arbitrary files that contain sensitive information. Information harvested may aid in launching further attacks.

WebSphere Service Registry and Repository 7.5 and 8.5 are vulnerable.

IBM WebSphere Service Registry and Repository Multiple Directory Traversal Vulnerabilities

An attacker can exploit these issues using a web browser.

IBM WebSphere Service Registry and Repository Multiple Directory Traversal Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM WebSphere Service Registry and Repository Multiple Directory Traversal Vulnerabilities

References:

• IBM WebSphere Service Registry and Repository Home Page (IBM)
  
• Security Bulletin: Various security issues exist in WebSphere Service Registry a (IBM)
  
• Security Bulletin: Various security issues exist in WebSphere Service Registry a (IBM)