IBM Tivoli Workload Scheduler XML external entity injection

CVE-2022-22486

What is CVE-2022-22486?

IBM Tivoli Workload Scheduler versions 9.4, 9.5, and 10.1 are susceptible to an XML External Entity Injection (XXE) attack, which can be exploited by a remote attacker. By sending specially crafted XML data, an attacker may gain access to sensitive information or exhaust system memory resources, leading to potential service disruptions or data breaches. This vulnerability necessitates immediate attention to mitigate risks associated with unauthorized access to data and denial of service.

References