8.2
CVE-2019-4433
- EPSS 3.85%
- Veröffentlicht 20.08.2019 19:15:16
- Zuletzt bearbeitet 21.11.2024 04:43:36
- Erkennungen
LoginIBM InfoSphere Global Name Management 5.0 and 6.0 and IBM InfoSphere Identity Insight 8.1 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162890.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Infosphere Global Name Management Version 5.0
Ibm ≫ Infosphere Global Name Management Version 6.0
Ibm ≫ Infosphere Identity Insight Version 8.1
Ibm ≫ Infosphere Identity Insight Version 9.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 3.85% | 0.888 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 8.2 | 3.9 | 4.2 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
|
| NIST | 6.4 | 10 | 4.9 |
AV:N/AC:L/Au:N/C:P/I:N/A:P
|
| IBM | 7.1 | 2.8 | 4.2 |
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
|
CWE-611 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
https://exchange.xforce.ibmcloud.com/vulnerabilities/162890
https://www.ibm.com/support/docview.wss?uid=ibm10958079
https://www.ibm.com/support/docview.wss?uid=ibm10958081