SE53160: Security APAR CVE-2012-4830 - CMVC 224463: Potential Information Disclosure vulnerability could expose user personal data.

WebSphere Commerce Version 7.0.0.7 Fix Pack

APAR status

• Closed as program error.

Error description

• A remote unauthenticated attacker could exploit a security
  vulnerability in WebSphere Commerce to expose user personal
  data. The attack can be performed manually and the effort
  required is comparatively low.
  

Local fix

Problem summary

• USERS AFFECTED:
  WebSphere Commerce Versions 6.0.0.0 to 6.0.0.11
  WebSphere Commerce Versions 7.0.0.0 to 7.0.0.6
  
  PROBLEM ABSTRACT:
  Security APAR CVE-2012-4830: Potential Information Disclosure
  vulnerability could expose user personal data
  
  BUSINESS IMPACT:
  Security exposure
  
  RECOMMENDATION:
  

Problem conclusion

• Security vulnerability addressed (CVE-2012-4830).
  -------------------------------------------------------------
  The latest available maintenance information can be obtained
  from the Recommended Fixes for WebSphere Commerce technote:
  http://www.ibm.com/support/docview.wss?rs=3046&uid=swg21261296
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WC BUS EDIT AS4

• Fixed component ID

  5724I3803

Applicable component levels

• R701 PSY

     UP