CVE-2017-1289 IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive informa...
HighCVSS 8.2
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125150.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm sdk | <= 6 | No fix listed |
| ibm sdk | <= 6r1 | No fix listed |
| ibm sdk | <= 7 | No fix listed |
| ibm sdk | <= 7r1 | No fix listed |
| ibm sdk | <= 8 | No fix listed |
| ibm runtimes for java technology | = 6.0, 6.1, 7.0, 7.1, 8.0 | No fix listed |
References
- 98401 third-party-advisory vdb-entry
- RHSA-2017:1220 vendor-advisory
- RHSA-2017:1221 vendor-advisory
- RHSA-2017:1222 vendor-advisory
- RHSA-2017:3453 vendor-advisory
- www.ibm.com patch vendor-advisory