Security Bulletin: Vulnerabilities in jdom affects IBM Common Licensing's Administration And Reporting Tool (ART) (CVE-2021-33813)

Summary

Security Vulnerablities have been addressed in IBM Common Licensing. An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request . A fix is available to address the vulnerability.

Vulnerability Details

CVEID:CVE-2021-33813
**DESCRIPTION:**JDOM is vulnerable to a denial of service, caused by an XXE issue in SAXBuilder. By sending a specially-crafted HTTP request, a remote attacker could exploit this vulnerability to cause the a denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/203804 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading and applying the suggested fix that uses upgraded version of FasterXML.

Apply IBM_LKS_Administration_And_Reporting_Tool_And_Agent_90_iFix6 from Fix Central.

Workarounds and Mitigations

None