Vulnerability Details CVE-2006-6637
The Servlet Engine and Web Container in IBM WebSphere Application Server (WAS) before 6.0.2.17, when ibm-web-ext.xmi sets fileServingEnabled to true and servlet caching is enabled, allows remote attackers to obtain JSP source code and other sensitive information via "specific requests."
Exploit prediction scoring system (EPSS) score
EPSS Score 0.01
EPSS Ranking 76.1%
CVSS Severity
CVSS v2 Score 5.0
References
- http://secunia.com/advisories/23414
- http://secunia.com/advisories/24478
- http://www-1.ibm.com/support/docview.wss?uid=swg21243541
- http://www-1.ibm.com/support/docview.wss?uid=swg24015155
- http://www-1.ibm.com/support/docview.wss?uid=swg27006876
- http://www.securityfocus.com/bid/21636
- http://www.securityfocus.com/bid/22991
- http://www.vupen.com/english/advisories/2006/5050
- http://www.vupen.com/english/advisories/2007/0970
- http://secunia.com/advisories/23414
- http://secunia.com/advisories/24478
- http://www-1.ibm.com/support/docview.wss?uid=swg21243541
- http://www-1.ibm.com/support/docview.wss?uid=swg24015155
- http://www-1.ibm.com/support/docview.wss?uid=swg27006876
- http://www.securityfocus.com/bid/21636
- http://www.securityfocus.com/bid/22991
- http://www.vupen.com/english/advisories/2006/5050
- http://www.vupen.com/english/advisories/2007/0970
Products affected by CVE-2006-6637
-
cpe:2.3:a:ibm:websphere_application_server:6.0.2.1
-
cpe:2.3:a:ibm:websphere_application_server:6.0.2.11
-
cpe:2.3:a:ibm:websphere_application_server:6.0.2.13
-
cpe:2.3:a:ibm:websphere_application_server:6.0.2.15
-
cpe:2.3:a:ibm:websphere_application_server:6.0.2.3
-
cpe:2.3:a:ibm:websphere_application_server:6.0.2.5
-
cpe:2.3:a:ibm:websphere_application_server:6.0.2.7
-
cpe:2.3:a:ibm:websphere_application_server:6.0.2.9