Description (CNA)
IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181482.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| IBM / Sterling Secure Proxy | affected 3.4.2; affected 3.4.3; affected 2.4.3; affected 2.4.2; affected 6.0.1; affected 6.0.0 |
| IBM / External Authentication Server | affected 6.0; affected 6.0.1 |
| IBM / Sterling External Authentication Server | affected 2.4.2; affected 2.4.3.2 |
CWE
No CWE identifiers supplied.
References
- https://www.ibm.com/support/pages/node/6249331
- https://www.ibm.com/support/pages/node/6249317
- https://exchange.xforce.ibmcloud.com/vulnerabilities/181482
ADP enrichment
No English description supplied.