Security Bulletin: Classloader Manipulation Vulnerability in IBM WebSphere Application Server shipped with IBM Content Collector (CVE-2014-0114)

Summary

There is a classloader manipulation vulnerability in the Apache Struts 1 used by the Administrative Console in IBM WebSphere Application Server that is shipped with IBM Content Collector.

Vulnerability Details

CVEID: CVE-2014-0114
Description: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. Together with IBM Content Collector Struts 1 is used by the Administrative Console in IBM WebSphere Application Server.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92889 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Affected Products and Versions

IBM Content Collector V2.2

Remediation/Fixes

Product

| VRMF|Remediation/First Fix
—|—|—
IBM Content Collector| 2.2.0.0 - 2.2.0.4| Apply Fix Pack 2.2.0.5-ICC-FP005, available from Fix Central

Workarounds and Mitigations

None