3rd party Vulnerability that happens to be on Clarity server

Products

• Clarity PPM On Premise
• Clarity PPM SaaS

Issue/Introduction

Receiving a vulnerability report of an issue that is related to Windows executables, OS files, any 3rd party software that is not delivered or used with Clarity. How to proceed? 

Resolution

 Broadcom Support can only advise on what is a Clarity vulnerability, which means, only files located in:

• $clarity install directory (where Clarity is installed, i.e. C:\clarity)
• Apache Tomcat directory (i.e. C:\apache-tomcat-9.0.71)
• Java JDK directory (i.e. C:\jdk-11.0.18+10)

Note: The folders location and naming may vary on different environments

Anything else that is outside of the abovementioned three folders is not something that is a Clarity dependency and Broadcom Support cannot advise on any of the vulnerabilities.

As a next step, we recommend to check on it with your IT Team

Additional Information

Also check Addressing Vulnerability in Clarity PPM when Reported by Security Scanning Tools