PT-2015-5499 · Ibm · Ibm Infosphere Master Data Management

Publicado 2015-05-25 · Atualizado 2015-05-26 · CVE-2015-1909

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Master Data Management (MDM) versions 10.1 through 10.1 before IF1 IBM InfoSphere Master Data Management (MDM) versions 11.0 through 11.0 before FP3 IBM InfoSphere Master Data Management (MDM) version 11.3 IBM InfoSphere Master Data Management (MDM) versions 11.4 through 11.4 before FP2

Description The issue allows remote attackers to read arbitrary files and obtain administrative access via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This is due to a flaw in the XML parser in the Reference Data Management component in the server.

Recommendations For IBM InfoSphere Master Data Management (MDM) versions 10.1 through 10.1 before IF1, apply IF1 to resolve the issue. For IBM InfoSphere Master Data Management (MDM) versions 11.0 through 11.0 before FP3, apply FP3 to resolve the issue. For IBM InfoSphere Master Data Management (MDM) version 11.3, update to a version that includes the fix for this issue. For IBM InfoSphere Master Data Management (MDM) versions 11.4 through 11.4 before FP2, apply FP2 to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-1909

Produtos afetados

Ibm Infosphere Master Data Management

Referências · 2

• http://www-01.ibm.com/support/docview.wss?uid=swg21700754 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-1909 · Nota de Segurança