UpHeron
All vulnerabilities

Servers and applications

CVE-2020-5016

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. When application security is disabled and JAX-RPC applications are present, an attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary xml files on the system. This does not occur if Application security is enabled. IBM…

Severity
Medium 6.5
Published
10 Mar 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
IBM WebSphere Application ServerServers and applications · cpe:a:ibm:websphere_application_server
  • From 7.0.0.0 up to 7.0.0.45
  • From 8.0.0.0 up to 8.0.0.15
  • From 8.5.0.0 up to 8.5.5.19
  • From 9.0.0.0 up to 9.0.5.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-5016
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-5016