Security Bulletin: IBM Sterling Order Management, IBM Sterling Configure, Price, Quote and Sterling Web Channel are affected by Apache Struts 2 security vulnerabilities

Vulnerability Details

• CVEID: CVE-2014-0112
  
  Description:
  Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by an incomplete fix related to ParametersInterceptor and the failure to restrict access to the class parameter. An attacker could exploit this vulnerability using the class parameter to manipulate the ClassLoader used by the application server to execute arbitrary code on the system.
  
  CVSS Base Score: 7.5
  CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92740 for more information
  CVSS Environmental Score*: Undefined
  CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)
• CVEID: CVE-2014-0113
  
  Description:
  Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by an incomplete fix related to CookieInterceptor and the failure to restrict access to the getClass() method. An attacker could exploit this vulnerability using CookieInterceptor when configured to accept all cookies to manipulate the ClassLoader used by the application server to execute arbitrary code on the system.
  
  CVSS Base Score: 7.5
  CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92742 for more information
  CVSS Environmental Score*: Undefined
  CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)
• CVEID: CVE-2014-0094
  
  Description:
  Apache Struts could allow a remote attacker to bypass security restrictions, caused by an error in ParametersInterceptor. An attacker could exploit this vulnerability using the class parameter to manipulate the ClassLoader used by the application server.
  
  CVSS Base Score: 5
  CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92205 for the current score
  CVSS Environmental Score*: Undefined
  CVSS Vector: (AV:N/AC:L/AU:N/C:N/I:P/A:N)
• CVEID: CVE-2014-0050
  
  Description:
  Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by the improper handling of Content-Type HTTP header for multipart requests. By sending a specially-crafted request, an attacker could exploit this vulnerability to cause the application to enter into an infinite loop.
  
  CVSS Base Score: 5
  CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/90987 for the current score
  CVSS Environmental Score*: Undefined
  CVSS Vector: (AV:N/AC:L/AU:N/C:N/I:N/A:P)