Security Bulletin: WAS traditional and liberty vulnerable to CVE-2014-7810 affects IBM Spectrum LSF Application Center

Summary

WAS traditional and liberty vulnerable to CVE-2014-7810 affects IBM Spectrum LSF Application Center.

Vulnerability Details

CVEID: CVE-2014-7810 DESCRIPTION: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the use of expression language. An attacker could exploit this vulnerability to bypass the protections of a Security Manager.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/103155 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)

Affected Products and Versions

Spectrum LSF Application Center 10.2

Remediation/Fixes

<Product

|

VRMF

|

APAR

|

Remediation/First Fix

—|—|—|—

Spectrum LSF Application Center

|

10.2

|

None

|

1. Download the fix PH02063 of WebSphere Application Server Liberty from the following location: https://www-01.ibm.com/support/docview.wss?uid=ibm10734645
2. Follow ‘18.0.0.2 Readme (archive)’ or ‘18.0.0.3 Readme (archive)’ to apply the fix.

Workarounds and Mitigations

None.