Security Bulletin: Potential vulnerability in WebSphere Application Server shipped with Tivoli Integrated Portal (CVE-2015-0899)


## Summary There is a potential vulnerability in WebSphere Application Server. ## Vulnerability Details **CVEID:** [_CVE-2015-0899_](<https://vulners.com/cve/CVE-2015-0899>) **DESCRIPTION:** Apache Struts could allow a remote attacker to bypass security restrictions, caused by an error in the MultiPageValidator implementation. An attacker could exploit this vulnerability using a modified page parameter to bypass restrictions and launch further attacks on the system. This vulnerability also affects other products. CVSS Base Score: 4.3 CVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/101770_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/101770>) for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N) ## Affected Products and Versions Tivoli Integrated Portal version 2.1.0 - Tivoli Integrated Portal version - ## Remediation/Fixes Principal Product and Version(s) | Affected Supporting Product and Version | Affected Supporting Product Security Bulletin ---|---|--- Tivoli Integrated Portal version 2.1.0 - 2.2.0 - | embedded Websphere Application Server version 7.0.x | # [Security Bulletin: Potential vulnerability in WebSphere Application Server (CVE-2015-0899)](<http://www-01.ibm.com/support/docview.wss?uid=swg22015348>) The Websphere security bulletin above provides a link to the required iFix to remediate the vulnerability. However, the iFix requires either eWAS or higher installed. TIP does not support upgrading Websphere fixpack independently. TIP or TIP or TIP must be applied which will upgrade eWAS to and above. Once TIP FP has been applied, the Websphere iFix can be applied as described in the Websphere bulletin. ## Workarounds and Mitigations Please refer to WAS iFix as described above ##

Affected Software

CPE Name Name Version
tivoli integrated portal any