CVE-2017-1477

CWE-611 — XML External Entity (XXE)3 documents3 sources

Severity

8.1HIGH

EPSS

0.6%

top 31.04%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Security Access Manager IBM Security Access Manager 9.0 Firmware

Timeline

PublishedNov 13

Latest updateMay 13

Description

IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 128612.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5ibm/security_access_manager9.0.3

▶NVDibm/security_access_manager_9.0_firmware9.0.3.0

🔴Vulnerability Details

GHSA

GHSA-pc2g-mv23-62mr: IBM Security Access Manager Appliance 9↗2022-05-13

▶

CVEList

CVE-2017-1477: IBM Security Access Manager Appliance 9↗2017-11-13

▶