IT19901: IMPROPER ACCESS CONTROL ALLOWS REGULAR USERS TO ACCESS ALL PAGES

APAR status

• Closed as program error.

Error description

• ERROR DESCRIPTION:Ø
  The IBM Sterling B2B Integrator application allows users to
  perform various actions using the Web interface, including
  creating business process and review JVM logs.
  Security Assurance identified that the pages providing these
  functionalities do not perform sufficient input validation and
  as such are subject to a directory traversal vulnerability.
  This results in disclosure of any file on the server for which
  the full path is known or can be guessed and which the
  "gentrans" user has permission to read.
  If an attacker is able to retrieve files containing sensitive
  information such as passwords, they can take control of the web
  server/web application.
  

Local fix

• STRRTC - 524032
  JX / JX
   Circumvention: None
  

Problem summary

• Users Affected:
  All
  
  Problem Description:
  Security vulnerabilities discovered in the IBM
  Sterling B2B Integrator Web Application - Improper access
  control  allows regular users to access all pages.
  
  
  Platforms Affected:
  All
  

Problem conclusion

• Resolution Summary:
  A code fix is provided.
  
  
  Delivered in:
  5020602_4
  5020603_2
  5020500_16
  5020601_8
  

Temporary fix

Comments

• Published On: 19-Aug-2017
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STR B2B INTEGRA

• Fixed component ID

  5725D0600

Applicable component levels

• R526 PSY

     UP