IBM WebSphere Portal contains a flaw that allows a remote attacker to traverse outside of a restricted path. The issue is due to the Dojo module not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied via the URL. This directory traversal attack would allow the attacker to gain access to arbitrary files.

Currently, there are no known workarounds or upgrades to correct this issue. However, IBM has released a patch to address this vulnerability. Check the vendor advisory or solution in the references section.

• CVE ID: 2012-2181 (see also: NVD)
• Secunia Advisory ID: 49855
• ISS X-Force ID: 75584
• Vendor URL: http://www-01.ibm.com/software/websphere/portal/
• Other Advisory URL: http://www.ibm.com/support/docview.wss?uid=swg1PM64172 [ Link is 404 ]
• Vendor Specific News/Changelog Entry: http://www.ibm.com/support/docview.wss?uid=swg21598363
  https://www.ibm.com/support/docview.wss?uid=swg21598363

• Not Available