Описание
IBM WebSphere Application Server 5.0.x before 5.02.15, 5.1.x before 5.1.1.8, and 6.x before fixpack V6.0.2.5, when session trace is enabled, records a full URL including the queryString in the trace logs when an application encodes a URL, which could allow attackers to obtain sensitive information.
Ссылки
- Third Party AdvisoryVDB Entry
- Vendor Advisory
- Vendor Advisory
- Third Party AdvisoryVDB Entry
- Permissions RequiredThird Party Advisory
- Third Party AdvisoryVDB Entry
- Vendor Advisory
- Vendor Advisory
- Third Party AdvisoryVDB Entry
- Permissions RequiredThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 5.0.0 (включая) до 5.02.15 (исключая)Версия от 5.1.0 (включая) до 5.1.1.8 (исключая)Версия от 6.0.0 (включая) до 6.0.2.5 (исключая)
Одно из
cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*
EPSS
Процентиль: 98%
0.51951
Средний
4.3 Medium
CVSS2
Дефекты
CWE-200
Связанные уязвимости
github
почти 4 года назад
IBM WebSphere Application Server 5.0.x before 5.02.15, 5.1.x before 5.1.1.8, and 6.x before fixpack V6.0.2.5, when session trace is enabled, records a full URL including the queryString in the trace logs when an application encodes a URL, which could allow attackers to obtain sensitive information.
EPSS
Процентиль: 98%
0.51951
Средний
4.3 Medium
CVSS2
Дефекты
CWE-200