Description (CNA)
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, or to conduct a server-side request forgery attack. IBM X-Force ID: 280401.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| IBM / WebSphere Application Server | affected 8.5, 9.0 |
| IBM / WebSphere Application Server Liberty | affected 17.0.0.3 through 24.0.0.5; affected cpe:2.3:a:ibm:websphere_application_server:17.0.0.3:*:*:*:liberty:*:*:*; affected cpe:2.3:a:ibm:websphere_application_server:24.0.0.5:*:*:*:liberty:*:*:* |
CWE
CWE-611
References
- https://www.ibm.com/support/pages/node/7148426
- https://exchange.xforce.ibmcloud.com/vulnerabilities/280401
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.