PT-2017-7599 · Ibm · Ibm Cognos Business Intelligence

Jakub Palaczynski · Publicado 2017-06-07 · Atualizado 2017-06-14 · CVE-2016-0254

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions IBM Cognos Business Intelligence versions 10.1 through 10.2

Description The issue is caused by an XML External Entity Injection (XXE) error when processing XML data, allowing a remote authenticated attacker to consume all available CPU resources and cause a denial of service.

Recommendations For versions 10.1 and 10.2, consider restricting access to XML data processing until a fix is available. As a temporary workaround, limit the CPU resources available to the application to prevent complete consumption. Avoid using the XML processing feature in the affected versions until the issue is resolved.

Correção

DoS

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2016-0254

Produtos afetados

Ibm Cognos Business Intelligence

Referências · 5

• https://osv.dev/vulnerability/CVE-2016-0254 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0254 · Nota de Segurança
• http://ibm.com/support/docview.wss?uid=swg22004036 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/110563 · Aviso do Fabricante
• http://securityfocus.com/bid/98971 · Nota