description: IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181482.
problem types: Obtain Information
affected:
{
product: Sterling Secure Proxy
vendor: IBM
versions:
status: affected, version: 3.4.2
status: affected, version: 3.4.3
status: affected, version: 2.4.3
status: affected, version: 2.4.2
status: affected, version: 6.0.1
status: affected, version: 6.0.0
}
{
product: External Authentication Server
vendor: IBM
versions:
status: affected, version: 6.0
status: affected, version: 6.0.1
}
{
product: Sterling External Authentication Server
vendor: IBM
versions:
status: affected, version: 2.4.2
status: affected, version: 2.4.3.2
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: UNPROVEN
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.0/S:U/AC:L/I:N/A:L/C:H/UI:N/PR:N/AV:N/RC:C/E:U/RL:O
version: 3.0
]