CVE-2006-6637

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-12-19 · updated 2026-06-16
Weakness: CWE-200

Description

The Servlet Engine and Web Container in IBM WebSphere Application Server (WAS) before 6.0.2.17, when ibm-web-ext.xmi sets fileServingEnabled to true and servlet caching is enabled, allows remote attackers to obtain JSP source code and other sensitive information via "specific requests."

Affected products

IBM WebSphere Application Server: 6.0.2.1, 6.0.2.3, 6.0.2.5, 6.0.2.7, 6.0.2.9, 6.0.2.11 (+2)

References

http://secunia.com/advisories/23414
http://secunia.com/advisories/24478
http://www-1.ibm.com/support/docview.wss?uid=swg21243541
http://www-1.ibm.com/support/docview.wss?uid=swg24015155
http://www-1.ibm.com/support/docview.wss?uid=swg27006876
http://www.securityfocus.com/bid/21636
http://www.securityfocus.com/bid/22991
http://www.vupen.com/english/advisories/2006/5050
http://www.vupen.com/english/advisories/2007/0970
http://secunia.com/advisories/23414
http://secunia.com/advisories/24478
http://www-1.ibm.com/support/docview.wss?uid=swg21243541

Get alerted when CVE-2006-6637 or the next vulnerability affects your stack