Security Bulletin: TADDM - Struts V1 ClassLoader manipulation vulnerability (CVE-2014-0114).

Summary

TADDM is vulnerable to Open Source Apache Struts V1 ClassLoader manipulation that allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes.

Vulnerability Details

CVE-ID: CVE-2014-0114
Description:
Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. An attacker could exploit this vulnerability using the class parameter of an ActionForm object to manipulate the ClassLoader and execute arbitrary code on the system.

CVSS Base Score: 7.5
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/92889&gt;
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Affected Products and Versions

TADDM 7.2.2

Remediation/Fixes

EFixes prepared on top of latest FixPack for each TADDM stream:

Workarounds and Mitigations

The only solution is to apply eFix prepared to specific TADDM version.
If you need eFix for other TADDM version, please contact IBM Support.