Description
SEC Consult Vulnerability Lab reported an XPath injection vulnerability in IBM Web Content Manager (versions 6.x, 7.x, 8.x). The discovered vulnerability can be exploited without authentication and therefore pose a high security risk - it allows extraction of configuration data from the server. An unauthenticated user is able to perform blind XPath Injection attacks e.g. get current application configuration, enumerate nodes and extract other valuable information from vulnerable installations of Web Content Manager.
Remediation
Apply the Interim Fix PI07777 (consult web references).
References
SEC Consult Vulnerability Lab Security Advisory 20131227-0
Fix available for Unauthorized Information Retrieval Security Vulnerability in IBM WebSphere Portal