Information disclosure in WebSphere Portal - CVE-2017-1698
Published: December 22, 2017 / Updated: December 25, 2017
Vulnerability identifier: #VU9735
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-1698
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The weakness exists due to unspecified condition that exist when returning an error message. A remote attacker can send a specially crafted request, trigger an error message response and access sensitive information within the error message.
Successful exploitation of the vulnerability may result in further attacks.
Affected software
WebSphere Portal
How to mitigate CVE-2017-1698
Install update from vendor's website.