CVE-2012-4834

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in LayerLoader.jsp in the theme component in IBM WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF19 and 8.0 before CF03 allows remote attackers to read arbitrary files via a crafted URI.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/51281Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PM76354Vendor Advisory
http://www.ibm.com/connections/blogs/PSIRT/entry/security_vulnerability_in_theme_component_for_websphere_portal_versions_7_0_0_x_and_8_0_cve2012_48344Patch, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg21617713Patch, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg24033155Patch, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/78914Third Party Advisory, VDB Entry
http://secunia.com/advisories/51281Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PM76354Vendor Advisory
http://www.ibm.com/connections/blogs/PSIRT/entry/security_vulnerability_in_theme_component_for_websphere_portal_versions_7_0_0_x_and_8_0_cve2012_48344Patch, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg21617713Patch, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg24033155Patch, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/78914Third Party Advisory, VDB Entry

Timeline

Published: Nov 30, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-48354.3Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and CVE-2012-48363.5Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and CVE-2012-48374.0IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote authenticated CVE-2012-48381.9IBM Flex System Chassis Management Module (CMM) and Integrated Management Module 2 (IMM2) allow local users to obtain sensitive information CVE-2012-48394.3The OSLC interface in the Web Client (aka CQ Web) in IBM Rational ClearQuest 7.1.2.x before 7.1.2.9 and 8.0.0.x before 8.0.0.5 allows remote CVE-2012-48405.0IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote attackers to c CVE-2012-48415.0Unspecified vulnerability in Tivoli Endpoint Manager for Remote Control Broker 8.2 before 8.2.1-TIV-TEMRC821-IF0002 allows remote attackers CVE-2012-48425.8Open redirect vulnerability in the web server in IBM Lotus Domino 8.5.x through 8.5.3 allows remote attackers to redirect users to arbitrary CVE-2012-48444.3Cross-site scripting (XSS) vulnerability in the web server in IBM Lotus Domino 8.5.x through 8.5.3 allows remote attackers to inject arbitra CVE-2012-48456.8The FTP client in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly manage privileges in an RBAC environment, which allow CVE-2012-48464.3IBM Lotus Notes 8.5.x before 8.5.3 FP3 does not include the HTTPOnly flag in a Set-Cookie header for a web-application cookie, which makes i CVE-2012-48474.0IBM Cognos Business Intelligence (BI) 8.4 and 8.4.1 allows remote authenticated users to cause a denial of service (CPU consumption) via a c