CVE-2022-22358

Name of the Vulnerable Software and Affected Versions IBM Sterling Partner Engagement Manager versions 6.1.2 through 6.2 IBM Sterling Partner Engagement Manager Cloud/SasS version 22.2

Description The issue allows a remote attacker to exploit an XML External Entity Injection (XXE) attack when processing XML data, potentially exposing sensitive information or consuming memory resources.

Recommendations For IBM Sterling Partner Engagement Manager versions 6.1.2 through 6.2, consider disabling XML processing until a patch is available. For IBM Sterling Partner Engagement Manager Cloud/SasS version 22.2, restrict access to XML data processing to minimize the risk of exploitation. As a temporary workaround, consider avoiding the use of XML data in the affected system until the issue is resolved.