XML External Entity Injection Vulnerability in IBM BigFix Inventory
CVE-2016-8980
8.1HIGH
Summary
IBM BigFix Inventory v9 is susceptible to an XML External Entity Injection (XXE) flaw that may lead to a denial of service. This vulnerability enables remote attackers to exploit the processing of XML data, potentially compromising sensitive information or exhausting memory resources. An attacker can leverage this issue to cause significant disruption to the affected service, highlighting the importance of securing XML parsing mechanisms.
Affected Version(s)
BigFix Inventory 9.2
References
CVSS V3.1
Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved