Security Bulletin: Vulnerability in Apache Tomcat affects IBM Algo Credit Administrator (CVE-2016-3092)

Summary

Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component, and is supplied with IBM Algo Credit Administrator. By sending file upload requests, an attacker could exploit this vulnerability to cause the server to become unresponsive.

Vulnerability Details

CVE-ID: CVE-2016-3092
Description: Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component. By sending file upload requests, an attacker could exploit this vulnerability to cause the server to become unresponsive.
CVSS Base Score: 5.300
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/114336&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

IBM Algo Credit Administrator 2.2.0

Remediation/Fixes

A fix has been created for version 2.2.0 of the named product. Download and install the fix as soon as practicable. Fix and installation instructions are provided at the URL listed below.

For ACA versions 2.1.1 and 2.1.2 IBM recommends upgrading to a fixed, supported version of the product.

Workarounds and Mitigations

None