CVE-2020-4782: 
IBM WebSphere App Server vulnerability analysis and mitigation

IBM WebSphere Application Server versions 7.0, 8.0, 8.5, and 9.0 were found to contain a directory traversal vulnerability identified as CVE-2020-4782. The vulnerability was discovered in late 2019 (December 30, 2019) and publicly disclosed on October 27, 2020. This vulnerability is particularly concerning as it affects the Admin Console component and is due to an incomplete fix for a previous vulnerability (CVE-2018-1770) (IBM Security).

The vulnerability allows remote attackers to traverse directories on the system by sending specially-crafted URL requests containing "dot dot" sequences (/../) to view arbitrary files on the system. The vulnerability has been assigned a CVSS Base score of 6.5 with a vector of CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, and the requirement for low-level privileges (IBM Security).

If exploited, this vulnerability could allow attackers to view arbitrary files on the affected system, potentially exposing sensitive information. The CVSS scoring indicates high confidentiality impact, while integrity and availability remain unaffected (IBM Security).

The vulnerability requires low attack complexity and can be exploited remotely by an attacker with low-level privileges. No authentication is required for exploitation, making it a significant security concern for exposed systems (IBM Security).

IBM has released fixes for all affected versions. For V9.0.0.0 through 9.0.5.5, users can either upgrade to Fix Pack 9.0.5.6 or later, or apply Interim Fix PH29871. For V8.5.0.0 through 8.5.5.18, users should upgrade to Fix Pack 8.5.5.19 or later, or apply Interim Fix PH29871. For V8.0.0.0 through 8.0.0.15 and V7.0.0.0 through 7.0.0.45, users must upgrade to the latest version within their series and apply Interim Fix PH29871. No workarounds are available for this vulnerability (IBM Security).