PT-2017-12962 · Ibm · Ibm Api Connect

Publicado 2017-06-27 · Atualizado 2017-07-05 · CVE-2017-1322

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions IBM API Connect version 5.0.6.0

Description The issue allows a remote attacker to perform an XML External Entity Injection (XXE) attack when the software processes XML data. This could lead to the exposure of highly sensitive information or the consumption of memory resources.

Recommendations For IBM API Connect version 5.0.6.0, consider disabling XML processing or restricting access to sensitive data until a fix is available. As a temporary workaround, restrict the use of XML external entities to minimize the risk of exploitation.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2017-1322

Produtos afetados

Ibm Api Connect

Referências · 5

• https://osv.dev/vulnerability/CVE-2017-1322 · Aviso do Fabricante
• http://securityfocus.com/bid/99258 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/125918 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1322 · Nota de Segurança
• http://ibm.com/support/docview.wss?uid=swg22003621 · Aviso do Fabricante