CVE-2016-0319

CWE-284 — Improper Access Control3 documents3 sources
Severity
7.5HIGH
EPSS
0.5%
top 32.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Jazz Reporting Service
Timeline
PublishedNov 25
Latest updateMay 17

Description

The XML parser in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote authenticated administrators to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDibm/jazz_reporting_service6.0, 6.0.1+1

Patches

Patch: www-01.ibm.com ↗Patch: www-01.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-4f7p-mhh6-p6r7: The XML parser in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6↗2022-05-17
▶
CVEList
CVE-2016-0319: The XML parser in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6↗2016-11-25
▶
CVE-2016-0319 (HIGH CVSS 7.5) | The XML parser in Lifecycle Query E | cvebase.io