A vulnerability and a security issue have been reported in Tivoli Netcool/Webtop, which can be exploited by malicious users to gain escalated privileges and by malicious people to disclose sensitive information.

1) A security issue exists due to the application using cached user permissions, which can be exploited to gain access to Webtop with escalated privileges.

Successful exploitation requires valid user credentials, and that an attacker has access to a browser that has been used to login to Webtop and has not been closed.

2) A vulnerability in Tomcat can be exploited by malicious people to disclose sensitive information.

For more information see vulnerability #2 in:
SA28878

The vulnerability and the security issue are reported in Tivoli Netcool/Webtop 2.1.0 prior to Fix Pack 5.

Solution
Update to Tivoli Netcool/Webtop 2.1.0 Fix Pack 5.

Provided and/or discovered by
1) Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg24018932
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ21888

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area