Security Bulletin: Open Source Apache Tomcat as used in IBM QRadar SIEM is vulnerable to a security bypass. (CVE-2014-7810)

Summary

Open Source Apache Tomcat Security Manager bypass.

Vulnerability Details

CVE-ID:CVE-2014-7810

**Description:**Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the use of expression language. An attacker could exploit this vulnerability to bypass the protections of a Security Manager.

**CVSS Base Score:**5.0 **CVSS Temporal Score: **See https://exchange.xforce.ibmcloud.com/vulnerabilities/103155 for the current score **CVSS Environmental Score:***Undefined **CVSS Vector:**AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected Products and Versions

· IBM QRadar 7.2.n

· IBM QRadar 7.1.n

Remediation/Fixes

· IBM QRadar/QRM/QVM/QRIF 7.2.5 Patch 5

· IBM QRadar SIEM 7.1 MR2 Patch 11 Interim Fix 3

Workarounds and Mitigations

None