Security Bulletin: Vulnerability in Apache Standard Taglibs affects IBM WebSphere Application Server (CVE-2015-0254) shipped with IBM Tivoli Netcool Performance Manager

Summary

There is an XML External Entity Injection (XXE) vulnerability in the Apache Standard Taglibs that affects IBM WebSphere Application Server.

Vulnerability Details

CVEID: CVE-2015-0254**
DESCRIPTION:** Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system, caused by an XML External Entity Injection (XXE) error when processing XML data. By sending specially-crafted XML data, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101550 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Please consult the security bulletin Vulnerability in Apache Standard Taglibs affects IBM WebSphere Application Server (CVE-2015-0254) for vulnerability details.

Affected Products and Versions

Principal Product and Version(s)

| Affected IBM WebSphere Application Server Version
—|—
Tivoli Netcool Performance Manager version 1.3.1, 1.3.2, 1.3.3, 1.4.0, 1.4.1, 1.4.2|

* Version 8.5.5 Full Profile and Liberty 
* Version 8.5 Full Profile and Liberty 
* Version 8.0 
* Version 7.0