CVE-2015-5038 — IBM Connections vulnerability

3 documents3 sources
Severity
7.5HIGHNVD
CNA6.5
EPSS
0.9%
top 24.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Connections
Timeline
PublishedJan 3
Latest updateMay 17

Description

IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 does not properly detect recursion during XML entity expansion, which allows remote attackers to cause a denial of service (CPU consumption and application crash) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDibm/connections3.0.1.1+3

🔴Vulnerability Details

2
GHSA
GHSA-r4cr-22jj-489p: IBM Connections 3↗2022-05-17
▶
CVEList
CVE-2015-5038: IBM Connections 3↗2016-01-03
▶
CVE-2015-5038 — IBM Connections vulnerability | cvebase