description: IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0.0.0 through V9.0.0.10, and WebSphere Message Broker V8.0.0.0 through V8.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to consume memory resources. IBM X-Force ID: 149639.
problem types: Denial of Service
affected:
{
product: Integration Bus
vendor: IBM
versions:
status: affected, version: 9.0.0.0
status: affected, version: 10.0.0.0
status: affected, version: 9.0.0.10
status: affected, version: 10.0.0.13
}
{
product: WebSphere Message Broker
vendor: IBM
versions:
status: affected, version: 8.0.0.0
status: affected, version: 8.0.0.9
}
{
product: App Connect
vendor: IBM
versions:
status: affected, version: 11.0.0.0
status: affected, version: 11.0.0.1
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
exploitCodeMaturity: UNPROVEN
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 4.6
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.0/A:L/AC:L/AV:N/C:N/I:N/PR:N/S:U/UI:N/E:U/RC:C/RL:O
version: 3.0
]