CVE-2016-0250 — XML External Entity (XXE) Injection in IBM Infosphere Information Server

CWE-611 — XML External Entity (XXE) Injection3 documents3 sources
Severity
5.4MEDIUMNVD
EPSS
0.3%
top 51.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Infosphere Information Server
Timeline
PublishedMar 12
Latest updateMay 14

Description

XML external entity (XXE) vulnerability in IBM InfoSphere Information Governance Catalog 11.3 before 11.3.1.2 and 11.5 before 11.5.0.1 allows remote authenticated users to read arbitrary files or cause a denial of service via crafted XML data. IBM X-Force ID: 110510.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:LExploitability: 2.8 | Impact: 2.5

Affected Packages1 packages

▶NVDibm/infosphere_information_server11.3 — 11.3.1.2+1

Patches

Patch: www-01.ibm.com ↗Patch: www-01.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-8c3g-h23m-g7wv: XML external entity (XXE) vulnerability in IBM InfoSphere Information Governance Catalog 11↗2022-05-14
▶
CVEList
CVE-2016-0250: XML external entity (XXE) vulnerability in IBM InfoSphere Information Governance Catalog 11↗2018-03-12
▶
CVE-2016-0250 — XML External Entity (XXE) Injection | cvebase