CVE-2015-0133 — XML External Entity (XXE) Injection in IBM Websphere Commerce

3 documents3 sources
Severity
5.0MEDIUMNVD
EPSS
0.4%
top 39.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Websphere Commerce
Timeline
PublishedMar 13
Latest updateMay 17

Description

IBM WebSphere Commerce 7.0 Feature Pack 4 through 8 allows remote attackers to read arbitrary files and possibly obtain administrative privileges via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

Patches

Patch: www-01.ibm.com ↗Patch: www-01.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-5jxf-j9mp-2pj5: IBM WebSphere Commerce 7↗2022-05-17
▶
CVEList
CVE-2015-0133: IBM WebSphere Commerce 7↗2015-03-13
▶