CVE-2016-0288 IBM Security AppScan Standard 8.7.x, 8.8.x, and 9.x before 9.0.3.2 and Security AppScan Enterprise allow remote authenticated users to read arbitrary files via an XML document containing an external e...
MediumCVSS 6.5
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
IBM Security AppScan Standard 8.7.x, 8.8.x, and 9.x before 9.0.3.2 and Security AppScan Enterprise allow remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm security appscan | = 8.7.0.0 | No fix listed |
| ibm security appscan | = 8.7.0.1 | No fix listed |
| ibm security appscan | = 8.8.0.0 | No fix listed |
| ibm security appscan | = 9.0.0.0 | No fix listed |
| ibm security appscan | = 9.0.0.1 | No fix listed |
| ibm security appscan | = 9.0.1.0 | No fix listed |
| ibm security appscan | = 9.0.1.1 | No fix listed |
| ibm security appscan | = 9.0.2.0 | No fix listed |
| ibm security appscan | = 9.0.2.1 | No fix listed |
| ibm security appscan | = 9.0.3.0 | No fix listed |
| ibm security appscan | = 9.0.3.1 | No fix listed |
References
- www-01.ibm.com vendor-advisory
- 1035927 vdb-entry