VMware vCenter Orchestrator and Alive Enterprise remote code execution vulnerability

a. Vulnerability in third party Apache Struts component
VMware vCenter Orchestrator is an application to automate management tasks. Alive Enterprise is an application to monitor processes. Both products embed Apache Struts which is a third party component.
The following vulnerability has been reported in Apache Struts 2.0.11 or earlier. A remote execution of code vulnerability could allow malicious users to bypass the ‘#’-usage protection built into the ParametersInterceptor, which could allow server side context objects to be manipulated.
The Common Vulnerabilities and Exposures project ( cve.mitre.org) has assigned the name CVE-2010-1870 to this vulnerability.
VMware would like to thank the Vulnerability Research Team of Digital Defense, Inc. for reporting this issue to us.
Apache Struts version 2.0.11 and earlier also contain vulnerabilities which have not been assigned CVE names. This advisory also addresses these vulnerabilities described at the following URLs:

• <http://struts.apache.org/2.2.1/docs/s2-002.html&gt;
• <http://struts.apache.org/2.2.1/docs/s2-003.html&gt;
• <http://struts.apache.org/2.2.1/docs/s2-004.html&gt;
  Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.