Lucene search

[email protected]CVE-2016-3033

HistoryDec 01, 2016 - 11:59 a.m.

CVE-2016-3033

2016-12-0111:59:05

CWE-611

[email protected]

web.nvd.nist.gov

ibm

appscan

source

8.7

9.0.3.3

xxe

vulnerability

nvd

cve-2016-3033

security

xml

denial of service

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

7.5 High

AI Score

Confidence

High

5.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:N/A:P

0.002 Low

EPSS

Percentile

56.5%

JSON

IBM AppScan Source 8.7 through 9.0.3.3 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected configurations

NVD

Node

ibmappscan_sourceMatch8.7

ibmappscan_sourceMatch8.7.0.1

ibmappscan_sourceMatch8.8

ibmappscan_sourceMatch9.0

ibmappscan_sourceMatch9.0.0.1

ibmappscan_sourceMatch9.0.1

ibmappscan_sourceMatch9.0.2

ibmappscan_sourceMatch9.0.3

ibmappscan_sourceMatch9.0.3.1

ibmappscan_sourceMatch9.0.3.2

ibmappscan_sourceMatch9.0.3.3

CPENameOperatorVersion
ibm:appscan_sourceibm appscan sourceeq8.7
ibm:appscan_sourceibm appscan sourceeq8.7.0.1
ibm:appscan_sourceibm appscan sourceeq8.8
ibm:appscan_sourceibm appscan sourceeq9.0
ibm:appscan_sourceibm appscan sourceeq9.0.0.1
ibm:appscan_sourceibm appscan sourceeq9.0.1
ibm:appscan_sourceibm appscan sourceeq9.0.2
ibm:appscan_sourceibm appscan sourceeq9.0.3
ibm:appscan_sourceibm appscan sourceeq9.0.3.1
ibm:appscan_sourceibm appscan sourceeq9.0.3.2

CPE	Name	Operator	Version
ibm:appscan_source	ibm appscan source	eq	8.7
ibm:appscan_source	ibm appscan source	eq	8.7.0.1
ibm:appscan_source	ibm appscan source	eq	8.8
ibm:appscan_source	ibm appscan source	eq	9.0
ibm:appscan_source	ibm appscan source	eq	9.0.0.1
ibm:appscan_source	ibm appscan source	eq	9.0.1
ibm:appscan_source	ibm appscan source	eq	9.0.2
ibm:appscan_source	ibm appscan source	eq	9.0.3
ibm:appscan_source	ibm appscan source	eq	9.0.3.1
ibm:appscan_source	ibm appscan source	eq	9.0.3.2

Rows per page:

1-10 of 111

References

www-01.ibm.com/support/docview.wss?uid=swg21987326

www.securityfocus.com/bid/92388

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

7.5 High

AI Score

Confidence

High

5.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:N/A:P

0.002 Low

EPSS

Percentile

56.5%

JSON

Related for CVE-2016-3033

prion1 cvelist1 nvd1