XML External Entity Vulnerability in IBM FileNet Workplace
CVE-2016-3055

8.1HIGH

Key Information:

Vendor

IBM
Status
Filenet Workplace
Vendor
CVE Published:
1 December 2016

What is CVE-2016-3055?

The XML External Entity vulnerability in IBM FileNet Workplace enables remote authenticated users to exploit the application by reading arbitrary files or inducing a denial of service through excessive memory consumption. This is achieved via specially crafted XML documents that contain external entity declarations and entity references, leading to potential information disclosure and system instability.

References

http://www.securityfocus.com/bid/92411
vdb-entryx_refsource_BID
http://www-01.ibm.com/support/docview.wss?uid=swg21987128
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.