Security Bulletin: FileNet Content Manager is affected by a HTTP Client vulnerability

Summary

FileNet Content Manager has addressed the following HTTP Client v3.0.1 and v4.0.1 vulnerability.

Vulnerability Details

CVEID: CVE-2012-5783 DESCRIPTION: Apache Commons HttpClient, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, could allow a remote attacker to conduct spoofing attacks, caused by the failure to verify that the server hostname matches a domain name in the subject’s Common Name (CN) field of the X.509 certificate. By persuading a victim to visit a Web site containing a specially-crafted certificate, an attacker could exploit this vulnerability using man-in-the-middle techniques to spoof an SSL server.
CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/79984&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

FileNet Content Manager 5.2.1

Remediation/Fixes

To resolve these vulnerabilities, install one of the patch sets listed below to upgrade HTTP Client v4.5.5 or higher.

5.2.1.7-P8CPE-IF004 - 9/28/2018

In the above table, the APAR links will provide more information about the fix.

Workarounds and Mitigations

None