PT-2021-13906

CVE-2021-20353

Published

2021-02-10

Updated

2021-02-12

Description by

CVSS 3.1

8.2

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 7.0 through 9.0

Description: The issue is related to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory resources.

Recommendations: For versions 7.0 through 9.0, update to a version that includes a fix for the XML External Entity Injection vulnerability. As a temporary workaround, consider restricting the processing of XML data from untrusted sources to minimize the risk of exploitation.

Exploitability

Fix

Impacts

Researchers

Longofo

R00T4Dm

Vendors

Affected products

Weakness enumeration

CWE-611: Improper Restriction of XML External Entity Reference

Related identifiers

CVE-2021-20353