Security Bulletin: IBM UrbanCode Release is affected by CVE-2021-24122

Summary

IBM UrbanCode Release version 6.2.2.7 - 6.2.5.2 are affected by CVE-2021-24122

Vulnerability Details

CVEID:CVE-2021-24122
**DESCRIPTION:**Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by a flaw when serving resources from a network location using the NTFS file system. By sending a specially-crafted request, an attacker could exploit this vulnerability to view the source code for JSPs in some configurations, and use this information to launch further attacks against the affected system.
CVSS Base score: 8.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/194894 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading to IBM UrbanCode Release version 6.2.5.3 or above.

Affected Supporting Product(s)

|

Remediation/Fix

—|—

IBM UrbanCode Release 6.2.2.7 – 6.2.5.2

|

Download IBM UrbanCode Release 6.2.5.5 – Includes Tomcat 8.5.69

Workarounds and Mitigations

None