IBM WebSphere Application Server Malformed Host Header JSP Source Disclosure

low Nessus Plugin ID 18047

Language:

Synopsis

The remote web server is affected by an information disclosure flaw.

Description

It is possible to make the remote web server disclose the source code of its JSP pages by requesting the pages with a nonexistent hostname in the HTTP 'Host' header request when WebSphere Application is sharing the document root of the web server. An attacker may use this flaw to get the source code of your CGIs and possibly to obtain passwords and other relevant information about this host.

Solution

Move JSP source files outside the web server document root.

Plugin Details

Severity: Low

ID: 18047

File Name: websphere_jsp_source.nasl

Version: 1.26

Type: remote

Family: CGI abuses

Published: 4/14/2005

Updated: 4/12/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.3

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 2

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2005-1112

Vulnerability Information

CPE: cpe:/a:ibm:websphere_application_server

Exploit Ease: No exploit is required

Exploited by Nessus: true

Vulnerability Publication Date: 4/13/2005

Reference Information

CVE: CVE-2005-1112

BID: 13160

Detections

Analytics