CVE-2013-6735

IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository (JCR) information via a modified Web Content Manager (WCM) URL.

• CWE-264

• http://osvdb.org/101255
• http://packetstormsecurity.com/files/124611/IBM-Web-Content-Manager-XPath-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://secunia.com/advisories/56161
• http://www-01.ibm.com/support/docview.wss?uid=swg1PI07777Not Applicable
• http://www-01.ibm.com/support/docview.wss?uid=swg21660289Patch, Vendor Advisory
• http://www.securityfocus.com/archive/1/530552/100/0/threaded
• http://www.securityfocus.com/bid/64496Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1029539Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89591
• https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_fix_available_for_unauthorized_information_retrieval_security_vulnerability_in_ibm_websphere_portal_cve_2013_6735Third Party Advisory, VDB Entry
• http://osvdb.org/101255
• http://packetstormsecurity.com/files/124611/IBM-Web-Content-Manager-XPath-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://secunia.com/advisories/56161
• http://www-01.ibm.com/support/docview.wss?uid=swg1PI07777Not Applicable
• http://www-01.ibm.com/support/docview.wss?uid=swg21660289Patch, Vendor Advisory
• http://www.securityfocus.com/archive/1/530552/100/0/threaded
• http://www.securityfocus.com/bid/64496Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1029539Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89591
• https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_fix_available_for_unauthorized_information_retrieval_security_vulnerability_in_ibm_websphere_portal_cve_2013_6735Third Party Advisory, VDB Entry

Published

Dec 22, 2013

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-6729Cross-site scripting (XSS) vulnerability in IBM QuickFile 1.…
• CVE-2013-6730IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x t…
• CVE-2013-6731IBM Netezza Performance Portal 2.x before 2.0.0.3 allows rem…
• CVE-2013-6732Cross-site scripting (XSS) vulnerability in the server in IB…
• CVE-2013-6733Cross-site scripting (XSS) vulnerability in the Web Applicat…
• CVE-2013-6734IBM WebSphere eXtreme Scale Client 7.1 through 8.6.0.4 does …
• CVE-2013-6737IBM System Storage Storwize V7000 Unified 1.3.x and 1.4.x be…
• CVE-2013-6738Cross-site scripting (XSS) vulnerability in IBM SmartCloud A…
• CVE-2013-6739IBM SPSS Modeler before 16 on UNIX allows remote authenticat…
• CVE-2013-6741IBM Maximo Asset Management 7.x before 7.1.1.7 LAFIX.2014031…
• CVE-2013-6742The Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and…
• CVE-2013-6743Cross-site scripting (XSS) vulnerability in the Meeting Serv…