PT-2023-6905 · Ibm · Ibm Financial Transaction Manager For Swift Services

Published 2023-09-01 · Updated 2023-09-08 · CVE-2023-35892

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager for SWIFT Services version 3.2.4

Description The issue is related to incorrect restriction of XML links to external objects, which can be exploited by a remote attacker to expose sensitive information or impact the availability of protected information. This is an XML External Entity Injection (XXE) attack when processing XML data, allowing the attacker to consume memory resources.

Recommendations For IBM Financial Transaction Manager for SWIFT Services version 3.2.4, consider disabling the XML processing feature until a patch is available to prevent exploitation of the XML External Entity Injection vulnerability. Restrict access to sensitive information and monitor memory resources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2023-07923

CVE-2023-35892

Affected Products

Ibm Financial Transaction Manager For Swift Services

References · 9

• https://exchange.xforce.ibmcloud.com/vulnerabilities/258786 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07923 · Security Note
• https://ibm.com/support/pages/node/7030359 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35892 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35892 · Vendor Advisory
• https://twitter.com/CVEnew/status/1698846920989724703 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1698932181844861143 · Twitter Post
• https://twitter.com/cracbot/status/1699301441138258342 · Twitter Post
• https://t.me/cibsecurity/69810 · Telegram Post