IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sensitive information, caused by sending a specially-crafted URL. This can lead the a

Successful exploitation of CVE-2019-4505 allows a remote attacker to read arbitrary files within a specific directory on the WebSphere Application Server. The sensitivity of the data exposed depends entirely on the contents of those files, which could include configuration files, application code, or even user data. This could lead to unauthorized access to sensitive information, potentially enabling further attacks such as privilege escalation or data breaches. The blast radius is limited to the files accessible within the targeted directory, but the potential impact can be significant depending on the data contained within.

Organizations running WebSphere Application Server in production environments, particularly those with legacy configurations or deployments that haven't been regularly patched, are at risk. Shared hosting environments where multiple applications share the same WebSphere instance are also particularly vulnerable.

• java / server:

find /opt/IBM/WebSphere/AppServer/profiles/*/config/cells/*/nodes/*/directories/ -name '.*.conf'

• generic web:

curl -I http://<target>/<vulnerable_directory>/../../../../etc/passwd

1. 2019-09-20Disclosure

   disclosure

1. 予約済み2019-01-03
2. 公開日2019-09-20
3. 更新日2024-09-17
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2019-4505 is to upgrade WebSphere Application Server to version 9.0.1 or later. If upgrading immediately is not feasible, consider implementing access controls to restrict access to the vulnerable directory. Review and harden the server's configuration to minimize the potential impact of a successful attack. While a WAF might offer some protection, it is not a substitute for patching. After upgrading, verify the fix by attempting to access the vulnerable directory with a crafted URL; access should be denied.