Lucene search

IBM015660C53A2EF5180FCFE61F2516B3536DB15C251855C2F4ACD6787B574DC049

HistoryJan 17, 2024 - 2:54 a.m.

Security Bulletin: Vulnerabilities in Apache Struts library affect Tivoli Netcool/OMNIbus WebGUI (CVE-2023-50164)

2024-01-1702:54:37

www.ibm.com

apache struts

tivoli netcool

omnibus webgui

remote code execution

file upload

path traversal

vulnerability

fix pack.

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

Low

EPSS

0.09

Percentile

94.6%

JSON

Summary

Apache Struts is used by Tivoli Netcool/OMNIbus WebGUI as part of its web client component. The fix includes Apache Struts v2.5.33.

Vulnerability Details

CVEID:CVE-2023-50164
**DESCRIPTION:**Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the handling of file upload parameters, which, if manipulated, can lead to unauthorized path traversal. By uploading a specially crafted archive file containing “dot dot” sequences (/…/), an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/273374 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Tivoli Netcool/OMNIbus_GUI	8.1.0 Fix Pack 32

Remediation/Fixes

Product	VRMF	Ticket	Remediation/First Fix
Tivoli Netcool/OMNIbus WebGUI	8.1.0	KT61430	Apply Fix Pack 33 Build 49
(Fix Pack for WebGUI 8.1.0 Fix Pack 33)

Workarounds and Mitigations

Upgrade to WebGUI 8.1.0 Fix Pack 33 Build 49.

Affected configurations

Vulners

Node

ibmtivoli_netcool\/omnibusMatch8.1.0

VendorProductVersionCPE
ibmtivoli_netcool\/omnibus8.1.0cpe:2.3:a:ibm:tivoli_netcool\/omnibus:8.1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	tivoli_netcool\/omnibus	8.1.0	cpe:2.3:a:ibm:tivoli_netcool\/omnibus:8.1.0:::::::*

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

Low

EPSS

0.09

Percentile

94.6%

JSON

Related for 015660C53A2EF5180FCFE61F2516B3536DB15C251855C2F4ACD6787B574DC049