CVE-2019-4505
mediumpriority · track · 22EPSS 0.024 · 84 %ileEUUSEPSS · scored 2026-10-27
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sensitive information, caused by sending a specially-crafted URL. This can lead the attacker to view any file in a certain directory. IBM X-Force ID: 164364.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.7–5.3
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (8)
Products and version ranges known to be affected.
- ibm websphere application server8.5.0.0 → 8.5.5.16nvdUScpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*
- ibm websphere application server9.0.0.0 → 9.0.5.0nvdUScpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*
- ibm websphere virtual enterprise= 7.0nvdUScpe:2.3:a:ibm:websphere_virtual_enterprise:*:*:*:*:*:*:*:*
- ibm websphere virtual enterprise= 8.0nvdUScpe:2.3:a:ibm:websphere_virtual_enterprise:*:*:*:*:*:*:*:*
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (35)
External citations — patches, advisories, analysis.
- https://exchange.xforce.ibmcloud.com/vulnerabilities/164364cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2019-4505cnnvd
- https://vigilance.fr/vulnerability/IBM-WebSphere-Application-Server-directory-traversal-via-Admin-Network-Deployment-30357cnnvd
- https://www.auscert.org.au/bulletins/ESB-2019.3531/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2019.3977/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2019.4238/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2019.4596/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2019.4787/cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan