CVE-2016-0254 — XML External Entity (XXE) Injection in IBM Cognos Business Intelligence

CWE-611 — XML External Entity (XXE) Injection7 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.5%
top 34.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Cognos Business Intelligence
Timeline
PublishedJun 7
Latest updateMay 17

Description

IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote authenticated attacker could exploit this vulnerability to consume all available CPU resources and cause a denial of service. IBM X-Force ID: 110563.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5ibm/cognos_business_intelligence5 versions+4

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-rrh8-365p-pw96: IBM Cognos Business Intelligence 10↗2022-05-17
▶
CVEList
CVE-2016-0254: IBM Cognos Business Intelligence 10↗2017-06-07
▶

💬Community

2
Bugzilla
CVE-2016-9036 CVE-2016-9037 tarantool: Multiple DoS vulnerabilities↗2016-12-21
▶
Bugzilla
CVE-2016-9577 spice: Buffer overflow in main_channel_alloc_msg_rcv_buf when reading large messages↗2016-12-05
▶
CVE-2016-0254 — XML External Entity (XXE) Injection | cvebase