PT-2016-1368
CVE-2016-0245
·
Publicado
2016-02-29
·
Atualizado
2017-02-19
Descrição por
CVSS 2.0
5.5
MédiaMétricasAV:N/AC:L/Au:S/C:P/I:N/A:P
Name of the Vulnerable Software and Affected Versions
IBM WebSphere Portal versions 8.0.x before 8.0.0.1 CF20
IBM WebSphere Portal versions 8.5.x before 8.5.0.0 CF10
Description
The issue is related to an XML External Entity (XXE) problem, where the XML parser allows remote authenticated users to read arbitrary files or cause a denial of service via an external entity declaration in conjunction with an entity reference. This is due to incorrect restriction of XML links to external objects.
Recommendations
For IBM WebSphere Portal versions 8.0.x before 8.0.0.1 CF20, update to 8.0.0.1 CF20 or later.
For IBM WebSphere Portal versions 8.5.x before 8.5.0.0 CF10, update to 8.5.0.0 CF10 or later.
Explorabilidade
Correção
Impactos
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾