IBM WebSphere Application Server 7.0.0.x <= / 8.0.0.x <= / 8.5.x < / 9.0.0.x < Admin Console Directory Traversal Vulnerability (CVE-2018-1770)

medium Nessus Plugin ID 128065


The remote web application server is affected by a directory traversal vulnerability.


The IBM WebSphere Application Server running on the remote host is version through, through, 8.5.x prior to, or 9.0.0.x prior to It is, therefore, affected by a directory traversal vulnerability in the admin console. An authenticated, remote attacker can exploit this, by sending a URI that contains directory traversal characters, to disclose the contents of files located outside of the server's restricted path.


Upgrade to IBM WebSphere Application Server or or later. Alternatively, upgrade to the minimal fix pack levels required by the interim fix and then apply Interim Fix PH01617.

See Also

Plugin Details

Severity: Medium

ID: 128065

File Name: websphere_local_cve-2018-1770.nasl

Version: 1.2

Type: local

Family: Web Servers

Published: 8/22/2019

Updated: 10/17/2019

Risk Information


Risk Factor: Medium

Score: 4.4


Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N

Temporal Vector: E:U/RL:OF/RC:C

CVSS Score Source: CVE-2018-1770


Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ibm:websphere_application_server

Required KB Items: installed_sw/IBM WebSphere Application Server

Exploit Ease: No known exploits are available

Patch Publication Date: 10/9/2018

Vulnerability Publication Date: 10/9/2018

Reference Information

CVE: CVE-2018-1770

BID: 105830