PT-2014-5078 · Ibm · Ibm Business Process Manager+1

Publicado 2014-08-17 · Atualizado 2017-08-29 · CVE-2014-3087

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager (BPM) versions 7.5 through 8.5.5 WebSphere Lombardi Edition versions 7.2 through 7.2.0.5

Description The issue allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This occurs in the callService.do endpoint.

Recommendations For IBM Business Process Manager (BPM) versions 7.5 through 8.5.5, consider restricting access to the callService.do endpoint until a fix is available. For WebSphere Lombardi Edition versions 7.2 through 7.2.0.5, consider disabling the XML external entity processing in the callService.do endpoint as a temporary workaround.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-3087

Produtos afetados

Ibm Business Process Manager

Websphere Lombardi Edition

Referências · 9

• http://secunia.com/advisories/60757 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3087 · Nota
• http://securityfocus.com/bid/69264 · Nota
• http://secunia.com/advisories/60752 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94112 · Nota
• http://secunia.com/advisories/60755 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg21679726 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3087 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg1JR50616 · Aviso do Fabricante