CVE-2015-1909

2015-05-2500:59:07

CWE-200

[email protected]

web.nvd.nist.gov

ibm

infosphere

mdm

xml parser

remote attack

arbitrary files

xxe

security vulnerability

cve-2015-1909

6.7 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

58.8%

JSON

The XML parser in the Reference Data Management component in the server in IBM InfoSphere Master Data Management (MDM) 10.1 before IF1, 11.0 before FP3, 11.3, and 11.4 before FP2 allows remote attackers to read arbitrary files, and consequently obtain administrative access, via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected configurations

NVD

Node

ibminfosphere_master_data_management_serverMatch10.1

ibminfosphere_master_data_management_serverMatch11.0

ibminfosphere_master_data_management_serverMatch11.3

ibminfosphere_master_data_management_serverMatch11.4

CPENameOperatorVersion
ibm:infosphere_master_data_management_serveribm infosphere master data management servereq10.1
ibm:infosphere_master_data_management_serveribm infosphere master data management servereq11.0
ibm:infosphere_master_data_management_serveribm infosphere master data management servereq11.3
ibm:infosphere_master_data_management_serveribm infosphere master data management servereq11.4

CPE	Name	Operator	Version
ibm:infosphere_master_data_management_server	ibm infosphere master data management server	eq	10.1
ibm:infosphere_master_data_management_server	ibm infosphere master data management server	eq	11.0
ibm:infosphere_master_data_management_server	ibm infosphere master data management server	eq	11.3
ibm:infosphere_master_data_management_server	ibm infosphere master data management server	eq	11.4