Description
SEC Consult Vulnerability Lab reported an XPath injection vulnerability in IBM Web Content Manager (versions 6.x, 7.x, 8.x). The discovered vulnerability can be exploited without authentication and therefore pose a high security risk - it allows extraction of configuration data from the server. An unauthenticated user is able to perform blind XPath Injection attacks e.g. get current application configuration, enumerate nodes and extract other valuable information from vulnerable installations of Web Content Manager.
Remediation
Apply the Interim Fix PI07777 (consult web references).
References
SEC Consult Vulnerability Lab Security Advisory 20131227-0
Fix available for Unauthorized Information Retrieval Security Vulnerability in IBM WebSphere Portal
Related Vulnerabilities
WordPress Plugin MStore API-Create Native Android & iOS Apps On The Cloud Security Bypass (3.1.9)
WordPress Plugin Minimal Coming Soon & Maintenance Mode-Coming Soon Page Security Bypass (2.15)
WordPress Plugin User Profile Picture Information Disclosure (2.4.0)
WordPress Plugin Memphis Documents Library Arbitrary File Download (3.1.5)