Security Bulletin: Classloader Manipulation Vulnerability in Rational Change (CVE-2014-0114)

Summary

There is a classloader manipulation vulnerability in Apache Struts 1 that is used by the IBM Rational Change application.

Vulnerability Details

| Subscribe to My Notifications to be notified of important product support alerts like this.

• Follow this link for more information (requires login with your IBM ID)
  —|—

CVEID: CVE-2014-0114

Description: Apache Struts could allow a remote attacker to execute arbitrary code on the system. Struts 1 is used by Rational Change application.

CVSS Base Score: 7.5 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/92889&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Affected Products and Versions

This problem affects the following versions of Rational Change application:

• Version 5.2
• Version 5.3
• Version 5.3.1

Remediation/Fixes

Upgrade to one of the following releases:

• For release 5.2, apply Rational Change Interim Fix 4 for 5.2.0.8

• For release 5.3, apply Rational Change Interim Fix 2 for 5.3.0.6

• For release 5.3.1, apply Rational Change Interim Fix 1 for 5.3.1.1

Workarounds and Mitigations

None