PT-2016-6739

CVE-2016-5971

·

Published

2016-09-26

·

Updated

2016-11-28

Description by

CVSS 3.1
7.1
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Name of the Vulnerable Software and Affected Versions IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance versions 2.0.0 through 2.0.2 FP7
Description The issue allows remote authenticated users to read arbitrary files or cause a denial of service due to an XML External Entity (XXE) issue. This occurs when an XML document containing an external entity declaration is used in conjunction with an entity reference.
Recommendations For IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance versions 2.0.0 through 2.0.2 FP7, update to version 2.0.2 FP8 to resolve the issue.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-611: Improper Restriction of XML External Entity Reference
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Related identifiers
CVE-2016-5971
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com