XML External Entity Injection Vulnerability in IBM Security Access Manager for Enterprise Single Sign-On
CVE-2019-4513

8.2HIGH

Key Information:

Vendor
IBM
Status
Security Access Manager For Enterprise Single Sign-on
Vendor
CVE Published:
26 August 2019

Summary

IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 is susceptible to an XML External Entity Injection (XXE) attack, enabling a remote attacker to manipulate XML data processing. Exploiting this vulnerability could lead to the unauthorized disclosure of sensitive information or the consumption of memory resources, potentially impacting system performance and data integrity.

Affected Version(s)

Security Access Manager for Enterprise Single Sign-On 8.2.2

References

http://www.ibm.com/support/docview.wss?uid=ibm10996716
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/164555
vdb-entryx_refsource_XF

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.