CVE-2016-2908 IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser. A remote attacker....
CriticalCVSS 9.1
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm security access manager 9.0 firmware | = 9.0.0 | No fix listed |
| ibm security access manager 9.0 firmware | = 9.0.0.1 | No fix listed |
| ibm security access manager 9.0 firmware | = 9.0.1.0 | No fix listed |
| ibm security access manager for mobile 8.0 firmware | = 8.0.0.1 | No fix listed |
| ibm security access manager for mobile 8.0 firmware | = 8.0.0.2 | No fix listed |
| ibm security access manager for mobile 8.0 firmware | = 8.0.0.3 | No fix listed |
| ibm security access manager for mobile 8.0 firmware | = 8.0.0.5 | No fix listed |
| ibm security access manager for mobile 8.0 firmware | = 8.0.1.0 | No fix listed |
| ibm security access manager for mobile 8.0 firmware | = 8.0.1.2 | No fix listed |
| ibm security access manager for mobile 8.0 firmware | = 8.0.1.3 | No fix listed |
| ibm security access manager for mobile 8.0 firmware | = 8.0.1.4 | No fix listed |
| ibm security access manager for web 8.0 firmware | = 8.0.0.1 | No fix listed |
| ibm security access manager for web 8.0 firmware | = 8.0.0.2 | No fix listed |
| ibm security access manager for web 8.0 firmware | = 8.0.0.3 | No fix listed |
| ibm security access manager for web 8.0 firmware | = 8.0.0.5 | No fix listed |
| ibm security access manager for web 8.0 firmware | = 8.0.1.0 | No fix listed |
| ibm security access manager for web 8.0 firmware | = 8.0.1.2 | No fix listed |
| ibm security access manager for web 8.0 firmware | = 8.0.1.3 | No fix listed |
| ibm security access manager for web 8.0 firmware | = 8.0.1.4 | No fix listed |
| ibm Access Manager | = 9.0 | No fix listed |
| ibm Access Manager | = 9.0.0.1 | No fix listed |
| ibm Access Manager | = 9.0.1 | No fix listed |
| ibm Access Manager | = 7.0.0 | No fix listed |
| ibm Access Manager | = 8.0.0 | No fix listed |
| ibm Access Manager | = 8.0.0.1 | No fix listed |
Show 10 more
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm Access Manager | = 8.0.0.2 | No fix listed |
| ibm Access Manager | = 8.0.0.3 | No fix listed |
| ibm Access Manager | = 8.0.0.4 | No fix listed |
| ibm Access Manager | = 8.0.0.5 | No fix listed |
| ibm Access Manager | = 8.0.1 | No fix listed |
| ibm Access Manager | = 8.0.1.2 | No fix listed |
| ibm Access Manager | = 8.0.1.3 | No fix listed |
| ibm Access Manager | = 8.0.1.4 | No fix listed |
| ibm Access Manager | = 9.0.0 | No fix listed |
| ibm Access Manager | = 9.0.1.0 | No fix listed |
References
- www.ibm.com patch vendor-advisory
- 95295 third-party-advisory vdb-entry
- 1038506 vdb-entry