Security Bulletin
Summary
We have identified that the IBM Kenexa LCMS Premier is affected by one or more security vulnerabilities. Fixes for these vulnerabilities are included in LCMS Premier version 12.3 and above .
If you have any of the affected versions and are an On Premise customer , please consider upgrading your LCMS Premier sites to version 12.3 and above.
Vulnerability Details
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Security component could allow an unauthenticated attacker to cause high confidentiality impact, high integrity impact, and no availability impact.
CVSS Base Score: 7.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/141939 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVEID: CVE-2018-1517
DESCRIPTION: A flaw in the java.math component in IBM SDK, Java Technology Edition may allow an attacker to inflict a denial-of-service attack with specially crafted String data.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/141681 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2018-2952
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Concurrency component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 3.7
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/146815 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Affected Products and Versions
|
Affected Product
|
Affected Version |
|---|---|
|
IBM Kenexa LCMS Premier On Premise
|
10.1 |
| IBM Kenexa LCMS Premier On Premise | 10.2 |
| IBM Kenexa LCMS Premier On Premise | 10.3 |
| IBM Kenexa LCMS Premier On Premise | 11.0 |
| IBM Kenexa LCMS Premier On Premise | 11.1 |
| IBM Kenexa LCMS Premier On Premise | 11.2 |
| IBM Kenexa LCMS Premier On Premise | 11.3 |
| IBM Kenexa LCMS Premier On Premise | 12.0 |
| IBM Kenexa LCMS Premier On Premise | 12.1 |
| IBM Kenexa LCMS Premier On Premise | 12.2 |
Remediation/Fixes
IBM recommends updating to the latest release for customers who are using an affected version . To do so you need to download the new version via IBM Passport Advantage.
Get Notified about Future Security Bulletins
References
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Historical Number
Advisory ID : 11819, 12959
Was this topic helpful?
Document Information
Modified date:
25 July 2019
UID
ibm10959051