A vulnerability has been reported in IBM WebSphere Application Server, which can be exploited by malicious people to disclose potentially sensitive information.

Certain input passed via the URL to the help servlet is not properly verified before being used. This can be exploited to disclose the contents of arbitrary files via directory traversal sequences.

The vulnerability is reported in versions 6.1.0.0 through 6.1.0.39, 7.0.0.0 through 7.0.0.18, and 8.0.0.0.

Solution
Apply fixes. Please see vendor's advisory for more details.

Provided and/or discovered by
Javier Castro, sxkeebler, and r@b13$, Digital Defense, Inc. Vulnerability Research Team.

Changelog
Further details available to Secunia VIM customers

Original Advisory
IBM:
http://www.ibm.com/support/docview.wss?uid=swg21509257

DDIVRT-2011-33:
http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0003.html

Deep Links
Links available to Secunia VIM customers