CVE-2005-4833

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

IBM WebSphere Application Server (WAS) 6.0 before 20050201, when serving pages in an Application WAR or an Extended Document Root, allows remote attackers to obtain the JSP source code and other sensitive information via "a specific JSP URL," related to lack of normalization of the URL format.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/34177
http://secunia.com/advisories/24478Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg21243541Patch, Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg24008815Patch, Vendor Advisory
http://www.securityfocus.com/bid/22991
http://www.vupen.com/english/advisories/2007/0970
http://osvdb.org/34177
http://secunia.com/advisories/24478Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg21243541Patch, Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg24008815Patch, Vendor Advisory
http://www.securityfocus.com/bid/22991
http://www.vupen.com/english/advisories/2007/0970

Timeline

Published: Dec 31, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-48345.0IBM WebSphere Application Server (WAS) 5.0.2.5 through 5.1.1.3 allows remote attackers to obtain JSP source code and other sensitive informa CVE-2005-48357.1The ath_rate_sample function in the ath_rate/sample/sample.c sample code in MadWifi before 0.9.3 allows remote attackers to cause a denial o CVE-2005-48367.8The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which all CVE-2005-483710.0snmp_api.c in snmpd in Net-SNMP 5.2.x before 5.2.2, 5.1.x before 5.1.3, and 5.0.x before 5.0.10.2, when running in master agentx mode, allow CVE-2005-48384.3Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attack CVE-2005-48395.0PureTLS before 0.9b5 does not clear optional Extensions and Algorithm.Parameters values before parsing, which might trigger an information l CVE-2005-48404.3The Outlook Express Address Book control, when using Internet Explorer 6, allows remote attackers to cause a denial of service (NULL derefer CVE-2005-48417.1The Outlook Progress Ctl control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of CVE-2005-48427.1The System Monitor Source Properties control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a CO CVE-2005-48437.8The SmartConnect Class control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of th CVE-2005-48447.1The CLSID_ApprenticeICW control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of t CVE-2005-48455.0The Java Plug-in 1.4.2_03 and 1.4.2_04 controls, and the 1.4.2_03 and 1.4.2_04 <applet> redirector controls, allow remote attackers to cause