Security Bulletin: Vulnerability in Apache Struts affect Tivoli Netcool/OMNIbus WebGUI (CVE-2015-0899)

Summary

Fix is available for vulnerability in Apache Struts affecting Tivoli Netcool/OMNIbus WebGUI (CVE-2015-0899).

Vulnerability Details

CVEID: CVE-2015-0899**
DESCRIPTION:** Apache Struts could allow a remote attacker to bypass security restrictions, caused by an error in the MultiPageValidator implementation. An attacker could exploit this vulnerability using a modified page parameter to bypass restrictions and launch further attacks on the system. This vulnerability also affects other products.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101770 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

Tivoli Netcool/OMNIbus WebGUI 8.1.0
Tivoli Netcool/OMNIbus WebGUI 7.4.0

Remediation/Fixes

Product

| VRMF|APAR|Remediation/Fix
—|—|—|—
Tivoli Netcool/OMNIbus WebGUI| 8.1.0| IV98709| Apply Fix Pack 11
(Fix Pack for WebGUI 8.1.0 Fix Pack 11)
Tivoli Netcool/OMNIbus WebGUI| 7.4.0| IV98709| Upgrade to WebGUI 8.1.0 and then apply Fix Pack 11
(Fix Pack for WebGUI 8.1.0 Fix Pack 11)

For unsupported versions IBM recommends upgrading to a fixed, supported version of the product.

Workarounds and Mitigations

None