CVE-2014-0954 — Improper Input Validation in IBM Websphere Portal

CWE-20 — Improper Input Validation3 documents3 sources
Severity
6.8MEDIUMNVD
EPSS
0.3%
top 51.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Websphere Portal
Timeline
PublishedMay 22
Latest updateMay 17

Description

IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 does not validate JSP includes, which allows remote attackers to obtain sensitive information, bypass intended request-dispatcher access restrictions, or cause a denial of service (memory consumption) via a crafted URL.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages1 packages

▶NVDibm/websphere_portal16 versions+15

Patches

Patch: www-01.ibm.com ↗Patch: www-01.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-97pp-g992-7v6w: IBM WebSphere Portal 6↗2022-05-17
▶
CVEList
CVE-2014-0954: IBM WebSphere Portal 6↗2014-05-22
▶
CVE-2014-0954 — Improper Input Validation in IBM | cvebase