Security Bulletin: Older version of common Open Source: batik-dom-1.9.1.jar found in the MaximoForgeViewerPlugIn which is shipped with IBM Maximo for Civil Infrastructure

Summary

There is an older version of common Open Source: batik-dom-1.9.1.jar found in the Maximo data loader which is shipped with IBM Maximo for Civil Infrastructure. In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class.

Vulnerability Details

CVEID:CVE-2018-8013
**DESCRIPTION:**Apache Batik could allow a remote attacker to obtain sensitive information, caused by an error when deserializing subclass of AbstractDocument. An attacker could exploit this vulnerability to reveal files and obtain sensitive information.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/143678 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

The recommended solution is to apply the interim fix, Fix Pack or PTF containing the APAR for the named product as soon as practical.

Download the correct version of the fix from the following link: Maximo for Civil Infrastructure Fix Pack 7.6.2.1.

Installation instructions for the fix are included in the readme document that is in the fix package.

Workarounds and Mitigations

None