{ "id": "CVE-2024-45072", "sourceIdentifier": "psirt@us.ibm.com", "published": "2024-10-16T17:15:16.750", "lastModified": "2024-10-21T13:41:20.463", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources." }, { "lang": "es", "value": "IBM WebSphere Application Server 8.5 y 9.0 es vulnerable a un ataque de inyecci\u00f3n de entidad externa (XXE) de XML al procesar datos XML. Un usuario privilegiado podr\u00eda aprovechar esta vulnerabilidad para exponer informaci\u00f3n confidencial o consumir recursos de memoria." } ], "metrics": { "cvssMetricV31": [ { "source": "psirt@us.ibm.com", "type": "Primary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "LOW" }, "exploitabilityScore": 1.2, "impactScore": 4.2 } ] }, "weaknesses": [ { "source": "psirt@us.ibm.com", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-611" } ] } ], "configurations": [ { "operator": "AND", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.5.0.0", "versionEndIncluding": "8.5.5.26", "matchCriteriaId": "7953E024-F84E-4277-BA52-93F5B1091E23" }, { "vulnerable": true, "criteria": "cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0.0", "versionEndIncluding": "9.0.5.21", "matchCriteriaId": "185CEF83-9BF7-4567-B2EC-CCF59F567AF3" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:o:hp:hp-ux:-:*:*:*:*:*:*:*", "matchCriteriaId": "F480AA32-841A-4E68-9343-B2E7548B0A0C" }, { "vulnerable": false, "criteria": "cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*", "matchCriteriaId": "E492C463-D76E-49B7-A4D4-3B499E422D89" }, { "vulnerable": false, "criteria": "cpe:2.3:o:ibm:i:-:*:*:*:*:*:*:*", "matchCriteriaId": "C684FC45-C9BA-4EF0-BD06-BB289450DD21" }, { "vulnerable": false, "criteria": "cpe:2.3:o:ibm:z\\/os:-:*:*:*:*:*:*:*", "matchCriteriaId": "0E97A964-6F9E-4C87-9B90-21AE2C1DF52F" }, { "vulnerable": false, "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1" }, { "vulnerable": false, "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA" }, { "vulnerable": false, "criteria": "cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:*:*", "matchCriteriaId": "91F372EA-3A78-4703-A457-751B2C98D796" } ] } ] } ], "references": [ { "url": "https://www.ibm.com/support/pages/node/7173263", "source": "psirt@us.ibm.com", "tags": [ "Vendor Advisory" ] } ] }