CVE-2013-4006

Vulnerability

IBM WebSphere Application Server (WAS) Liberty Profile versions 8.5 prior to 8.5.5.1 contain a vulnerability where unspecified files are created with weak permissions. This allows local users to read sensitive information through standard filesystem operations. The affected versions are Liberty Profile 8.5.0.0 through 8.5.5.0.

Exploitation

An attacker with local access to the system can exploit this vulnerability by simply reading the affected files using standard filesystem commands. No authentication beyond local user access is required, and no user interaction is needed.

Impact

Successful exploitation leads to the disclosure of sensitive information contained in the files with weak permissions. The impact is limited to confidentiality, as the attacker can read but not modify or delete the files.

Mitigation

IBM released Fix Pack 8.5.5.1 to address this vulnerability. Users should upgrade to version 8.5.5.1 or later. No workarounds are documented in the available references [1].