Security Bulletin: Security Vulnerability in Portlet Container

Summary

A URL manipulation allows to reach JSP and other resources within the WEB-INF and other directories of a portlet application. This can be done using a feature which is part of the JSR 286 Specification. Because of the current implementation of the portlet container also JSR 168 compliant portlets are affected. Basically, looking at a Portal URL for the serveResource feature, directory and file names are visible in clear text. Trying to change these to another file within the portlet application should be sufficient.

Vulnerability Details

CVEID: CVE-2014-3083**
DESCRIPTION:** IBM WebSphere Application Server could allow a remote attacker to obtain sensitive information, caused by the failure to restrict access to resources located within the web application. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information.
CVSS Base Score: 5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/93954&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

Affected Products and Versions

Rational Application Developer 9.1.0.1 and earlier

Remediation/Fixes

Update the portlet tools in the product to address this vulnerability: