JR60619: FILE UPLOAD JSP FILES ARE DIRECTLY ACCESSIBLE FROM THE URL: HTTP://<SERVER IP>:7507/CCD_CONNECTIVITY/IMAGE_UPLOADER.JSP

IBM InfoSphere Master Data Management Collaboration Server Version 11.6.0, Fix Pack 12 IF 2
IBM InfoSphere Master Data Management Collaboration Server Version 11.6.0, Fix Pack 12 IF 2

APAR status

• Closed as program error.

Error description

• File upload jsp files are directly accessible from the URL:
  http://<Server
  Ip>:7507/ccd_connectivity/image_uploader.jsp.
   In such scenario an adversary can upload malicious files to
  the web server through the upload option.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All Master Data Management Collaboration Server              *
  * implementations are affected by this issue.                  *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * File upload jsp files are directly accessible from the URL:  *
  * http://<Server                                               *
  * Ip>:7507/ccd_connectivity/image_uploader.jsp.                *
  *  In such scenario an adversary can upload malicious files to *
  * the web server through the upload option.                    *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• Customers facing the issue reported by this APAR apply Master
  Data Management Collaboration Server version MDMCE 11.6.0-FP012
  IF002 or later to gain resolution to this problem.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  MDM SERVER FOR

• Fixed component ID

  5724V5100

Applicable component levels