CVE-2009-0508

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-03-16 · updated 2026-06-16
Weakness: CWE-200

Description

The Servlet Engine/Web Container and JSP components in IBM WebSphere Application Server (WAS) 5.1.0, 5.1.1.19, 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.23, and 7.0 before 7.0.0.3 allow remote attackers to read arbitrary files contained in war files in (1) web-inf, (2) meta-inf, and unspecified other directories via unknown vectors, related to (a) web-based applications and (b) the administrative console.

Affected products

IBM WebSphere Application Server: 5.1.0, 5.1.1.19, 6.0.2, 6.0.2.1, 6.0.2.3, 6.0.2.5 (+28)

References

http://secunia.com/advisories/34283
http://secunia.com/advisories/34876
http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg24022456
http://www-01.ibm.com/support/docview.wss?uid=swg1PK81387
http://www-01.ibm.com/support/docview.wss?uid=swg21380233
http://www-01.ibm.com/support/docview.wss?uid=swg21380376
http://www-01.ibm.com/support/docview.wss?uid=swg27006876
http://www.securityfocus.com/bid/34104
http://www.vupen.com/english/advisories/2009/0704
http://www.vupen.com/english/advisories/2009/1188
http://www.vupen.com/english/advisories/2009/1464
https://exchange.xforce.ibmcloud.com/vulnerabilities/49085

Get alerted when CVE-2009-0508 or the next vulnerability affects your stack