T97-2015: Security vulnerability found in the BIOVIA Discoverant KnowledgeNet URL

Operating System
All supported operating systems

Description
Under the right conditions, a user with access to a Discoverant server may be able to obtain reports that are stored in KnowledgeNet. This user would not need to have a Discoverant account or need to be logged into Discoverant to retrieve this information. This user would need to know the name of the report, know exactly where it is kept, and know how to modify the URL to retrieve it.

Resolution:
BIOVIA strongly recommends that all customers resolve this security vulnerability by modifying the web.xml file located in this folder path:

%Install directory%\Discoverant\Server\tomcat- (your version)\webapps\Aegis-KN\WEB-INF\web.xml

The process to change this file is:

1. Stop the Discoverant services

2. Open the web.xml file in a text editor

3. Locate the segment below in the web.xml file

<!-- servlet-mapping>

<servlet-name>ViewerServlet</servlet-name>

<url-pattern>/output/*</url-pattern>

</servlet-mapping -->

4. Replace the segment in step three with the one below (changes are marked in bold text):

<servlet-mapping>

<servlet-name>ControlServlet</servlet-name>

<url-pattern>/output/*</url-pattern>

</servlet-mapping>

5. Save changes and then restart the Discoverant services.

Defect # DISCO-11076

How to contact BIOVIA Support
If you have any questions, please contact BIOVIA Support.