CVE-2014-0954: IBM WebSphere Portal

Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days.

IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 does not validate JSP includes, which allows remote attackers to obtain sensitive information, bypass intended request-dispatcher access restrictions, or cause a denial of service (memory consumption) via a crafted URL.

Affected products

• IBM WebSphere Portal: version 6.1.0.0 only; version 6.1.0.1 only; version 6.1.0.2 only; version 6.1.0.3 only; version 6.1.0.4 only; version 6.1.0.5 only; …

Published 2014-05-22. Last modified 2026-06-17.