{"id":"CVE-2013-6735","aliases":["EUVD-2013-6537","GHSA-367j-phrj-8hv2"],"status":"published","title":"IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6...","description":"IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository (JCR) information via a modified Web Content Manager (WCM) URL.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03599,"percentile":0.89539,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2013-12-22T15:00:00Z","modified":"2026-06-17T00:00:52Z","products":[{"vendor":"ibm","product":"websphere_portal"}],"references":[{"url":"http://secunia.com/advisories/56161","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/530552/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/bid/64496","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/89591","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://osvdb.org/101255","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21660289","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1PI07777","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","Not Applicable"]},{"url":"https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_fix_available_for_unauthorized_information_retrieval_security_vulnerability_in_ibm_websphere_portal_cve_2013_6735","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1029539","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/124611/IBM-Web-Content-Manager-XPath-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6735"},{"url":"https://github.com/advisories/GHSA-367j-phrj-8hv2"}],"sources":{"cve":[{"id":"CVE-2013-6735","description":"IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository (JCR) information via a modified Web Content Manager (WCM) URL.","status":"published","published":"2013-12-22T15:00:00Z","modified":"2024-08-06T17:46:22.701Z","updated_at":"2026-11-02T14:34:57.195423Z"}],"euvd":[{"id":"EUVD-2013-6537","description":"IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository (JCR) information via a modified Web Content Manager (WCM) URL.","status":"published","published":"2013-12-22T15:00:00Z","modified":"2024-08-06T17:46:22Z","updated_at":"2026-11-03T01:56:25.224612Z"}],"ghsa":[{"id":"GHSA-367j-phrj-8hv2","title":"IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6...","description":"IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository (JCR) information via a modified Web Content Manager (WCM) URL.","status":"published","published":"2022-05-14T02:54:05Z","modified":"2023-02-02T05:06:50Z","updated_at":"2026-11-02T14:52:22.708662Z"}],"nvd":[{"id":"CVE-2013-6735","description":"IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository (JCR) information via a modified Web Content Manager (WCM) URL.","status":"published","published":"2013-12-22T15:16:04.443Z","modified":"2026-06-17T00:00:52.84Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:44.596064Z"}]}}