Buy or Renew
Buy or Renew
Cisco + Splunk: Itā€™s a new day for your data. Learn more.
Ā 
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results forĀ 
Search instead forĀ 
Did you mean:Ā 
cancel
Start a conversation
749
Views
20
Helpful
3
Replies

CSCvm14030 - Evaluation of positron for Struts remote code execution vulnerability August 2018 - 1

toyip
Cisco Employee
Cisco Employee

ā€Ž09-06-2018 01:45 PM

Just want to confirm if the newly released patch 3 for ISE 2.4 addresses the Apache Struts vulnerability as per release notes and applying the Struts2-fix-2.0to2.4 fix is not necessary if patch 3 (for ISE 2.4) is installed.

Labels:
0 Helpful
3 Replies 3

Leo Laohoo
Hall of Fame
Hall of Fame

ā€Ž09-06-2018 05:13 PM - edited ā€Ž09-06-2018 05:22 PM

The fix for this is called "Struts2-fix-2.0to2.4".

I was made aware ISE 2.4P3 doesn't fix the vulnerability & hotfix is required.

toyip
Cisco Employee
Cisco Employee
In response to Leo Laohoo

ā€Ž09-07-2018 11:31 AM

I just confirmed internally that ISE2.4, P3 does address the vulnerability. The release notes for ISE2.4 also confirms it.

Leo Laohoo
Hall of Fame
Hall of Fame
In response to toyip

ā€Ž09-07-2018 05:14 PM

Ok, thanks for the confirmation.
Customers Also Viewed These Support Documents