Security Bulletin: Struts Vulnerability - Order Management does contain the Struts code and it is vulnerable with lower risk [CVE-2023-50164]

Summary

Order Management does contain the Struts code and it is vulnerable CVE-2023-50164, however the specific code related to the vulnerability is not in use, therefore the risk is lower. This bulletin identifies the steps to take to address the vulnerability.

Vulnerability Details

CVEID:CVE-2023-50164
**DESCRIPTION:**Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the handling of file upload parameters, which, if manipulated, can lead to unauthorized path traversal. By uploading a specially crafted archive file containing “dot dot” sequences (/…/), an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/273374 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

19 January 2024 (23.3.9.2-10.0.2309.2)

Please find release notes and fixes - <https://www.ibm.com/docs/en/order-management?topic=updating-resolved-issues&gt;

Container download-<https://www.ibm.com/docs/en/order-management-sw/10.0?topic=operator-obtaining-container-images-from-entitled-registry&gt;

On-Prem: <https://www.ibm.com/docs/en/order-management-sw/10.0?topic=installing-applying-fix-packs&gt;

Workarounds and Mitigations

None