Security Bulletin: Content Collector for Email affected by privilege escalation vulnerability in WebSphere Application Server

Summary

Content Collector for Email has addressed a privilege escalation vulnerability in WebSphere Application Server which could provide weaker than expected security when using the Administrative Console. An authenticated remote attacker could exploit this vulnerability to possibly gain elevated privileges.

Vulnerability Details

CVEID: CVE-2017-1731**
DESCRIPTION:** IBM WebSphere Application Server could provide weaker than expected security when using the Administrative Console. An authenticated remote attacker could exploit this vulnerability to possibly gain elevated privileges.
CVSS Base Score: 8.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/134912 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Content Collector for Email 3.0
Content Collector for Email 4.0
Content Collector for Email 4.0.1

Remediation/Fixes

Product

| VRM|Remediation
—|—|—
Content Collector for Email | 3.0 - 4.0.1| Use Content Collector for Email 4.0.1.8 Interim Fix 002

Follow steps in the Readme file in 4.0.1.8 Interim Fix 002 to install the fix applicable to your version.