7.1

CVE-2025-13096

XML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow -

IBM Business Automation Workflow containers V25.0.0 through V25.0.0-IF007, V24.0.1 - V24.0.1-IF007, V24.0.0 - V24.0.0-IF007 and IBM Business Automation Workflow traditional V25.0.0, V24.0.1, V24.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Business Automation Workflow SwEdition traditional Version <= 24.0.0
Ibm ≫ Business Automation Workflow Update - SwEdition containers Version <= 24.0.0
Ibm ≫ Business Automation Workflow Version 24.0.0 Update if001 SwEdition containers
Ibm ≫ Business Automation Workflow Version 24.0.0 Update if002 SwEdition containers
Ibm ≫ Business Automation Workflow Version 24.0.0 Update if003 SwEdition containers
Ibm ≫ Business Automation Workflow Version 24.0.0 Update if004 SwEdition containers
Ibm ≫ Business Automation Workflow Version 24.0.0 Update if005 SwEdition containers
Ibm ≫ Business Automation Workflow Version 24.0.0 Update if006 SwEdition containers
Ibm ≫ Business Automation Workflow Version 24.0.0 Update if007 SwEdition containers
Ibm ≫ Business Automation Workflow Version 24.0.1 SwEdition traditional
Ibm ≫ Business Automation Workflow Version 24.0.1 Update if001 SwEdition containers
Ibm ≫ Business Automation Workflow Version 24.0.1 Update if002 SwEdition containers
Ibm ≫ Business Automation Workflow Version 24.0.1 Update if004 SwEdition containers
Ibm ≫ Business Automation Workflow Version 24.0.1 Update if005 SwEdition containers
Ibm ≫ Business Automation Workflow Version 25.0.0 Update - SwEdition traditional
Ibm ≫ Business Automation Workflow Version 25.0.0 Update if001 SwEdition containers
Ibm ≫ Business Automation Workflow Version 25.0.0 Update if002 SwEdition containers
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.362
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
IBM 7.1 2.8 4.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://www.ibm.com/support/pages/node/7259321
Vendor Advisory