Security and Servlet 2.4 spec issues aside there's a few different ways you can do this. I'm not sure if Websphere supports it or not but in WebLogic 10 (I <pretty sure> JBoss does it too) you can share session data between applications as long as the war files are all contained in the same ear. There's a parameter you can add to the weblogic.xml file that allows all the session data to be shared with all apps that have that setting enabled. Since Websphere 5 is older I'm not too sure it's going to be supported.
There are also 3rd party applications such as Oracle Coherence that will help you do this. There are others but that's the only one that comes to mind right now.
You can also try to pass the sessionid of the session that holds the data you want into the JSP page where it's needed. You can then make a call to getSession and pass in the id...those methods are deprecated though (for reasons stated in the opening sentence) and there is no replacement so use at your own risk. I've never tried this so I don't know how good it would work.
We opted for the first option but it makes your build process a tad more complicated. We have someone looking for other third party apps but it's not a priority right now. [ May 28, 2008: Message edited by: Jeff Strike ]
Since cross context communication is not covered very extensivly, this tends to be very container specific. Therefore, I'm going to move this to our IBM/Websphere forum where you should be able to get information specific to Websphere.