Security Bulletin: The IBM® Engineering Lifecycle Management is impacted by vulnerabilties in Apache Commons Beanutils

Summary

Multiple vulnerabilities have been identified in Apache Commons Beanutils, which is used in IBM Engineering Lifecycle Management - IBM Jazz. This bulletin contains information regarding vulnerabilities and remediation actions.

Vulnerability Details

CVEID:CVE-2019-10086
**DESCRIPTION:**Apache Commons Beanutils could allow a remote attacker to gain unauthorized access to the system, caused by the failure to suppresses the class property in bean introspection by default. An attacker could exploit this vulnerability to gain unauthorized access to the classloader.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/166353 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2014-0114
**DESCRIPTION:**Apache Commons BeanUtils, as distributed in lib/commons-beanutils in Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. By using the class parameter of an ActionForm object, an attacker could exploit this vulnerability to manipulate the ClassLoader and execute arbitrary code on the system.
CVSS Base score: 6.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/92889 for the current score.
CVSS Vector:

Affected Products and Versions

Remediation/Fixes

Adopted new Apache commons-beanutils-1.9.4 version.

STEPS TO APPLY THE REMEDIATION:

Advising users who are on ELM 7.0, 7.0.1 or any other version below 7.0.2 to upgrade your products to Maintenance release 7.0.2 version as these products have reached end of life. Optionally, upgrade to the latest 7.0.3 version.

Workarounds and Mitigations

None