PT-2016-3757 · Ibm · Ibm Mashup Center

Publicado 2016-01-02 · Atualizado 2016-12-03 · CVE-2015-7400

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions IBM Mashup Center version 3.0.0.1

Description The issue allows remote authenticated users to cause a denial of service, specifically CPU consumption, by utilizing an XML external entity declaration in conjunction with an entity reference. This is related to an XML External Entity (XXE) issue.

Recommendations For IBM Mashup Center version 3.0.0.1, consider disabling the XML external entity processing to prevent exploitation until a patch is available. Restrict access to the Lotus Mashups component to minimize the risk of denial of service attacks.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2015-7400

Produtos afetados

Ibm Mashup Center

Referências · 5

• http://www-01.ibm.com/support/docview.wss?uid=swg21970392 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT12268 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-7400 · Nota de Segurança
• http://securitytracker.com/id/1035319 · Nota
• http://securityfocus.com/bid/77986 · Nota