IBM Jazz Foundation Missing Authorization Vulnerability Allowing Unauthorized Actions and Denial-of-Service

A vulnerability in IBM Jazz Foundation versions 7.0.2 (through iFix035), 7.0.3 (through iFix018), and 7.1.0 (through iFix004) could enable an unauthenticated remote attacker to modify server property files. This unauthorized modification could lead to the execution of unauthorized actions, ultimately causing a denial-of-service condition.

Impact

Exploitation of this vulnerability could result in unauthorized actions being performed on the server, followed by a denial-of-service condition.

Remediation

Users are advised to upgrade to version 7.0.2 iFix035, 7.0.3 iFix018, or 7.1.0 iFix004. After upgrading, set the Advanced property 'setup.isRegistrationHandlerServiceOpen' to 'False' under Jazz Team Server (JTS) > Server Administration > Advanced property page.