XML External Entity Vulnerability in IBM AppScan Source
CVE-2016-3033

8.1HIGH

Key Information:

Vendor

IBM
Status
Appscan Source
Vendor
CVE Published:
1 December 2016

What is CVE-2016-3033?

IBM AppScan Source versions 8.7 through 9.0.3.3 are susceptible to an XML External Entity (XXE) vulnerability. This allows remote authenticated users to exploit the system by crafting an XML document that contains an external entity declaration alongside an entity reference. This can lead to unauthorized access to arbitrary files or cause a denial of service due to memory consumption, posing significant risks to the security and functionality of the application.

References

http://www-01.ibm.com/support/docview.wss?uid=swg21987326
x_refsource_CONFIRM
http://www.securityfocus.com/bid/92388
vdb-entryx_refsource_BID

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.