Lucene search

IbmCVE-2016-9706

HistoryFeb 15, 2017 - 7:59 p.m.

CVE-2016-9706

2017-02-1519:59:01

CWE-611

ibm

web.nvd.nist.gov

ibm

integration bus

websphere

message broker

soap

xxe

denial of service

xml

security

vulnerability

nvd

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:P/I:N/A:C

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

AI Score

9.2

Confidence

High

EPSS

0.003

Percentile

68.0%

JSON

IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1997918.

Affected configurations

Nvd

Vulners

Node

ibmintegration_busMatch9.0

ibmintegration_busMatch10.0

ibmwebsphere_message_brokerMatch8.0

VendorProductVersionCPE
ibmintegration_bus9.0cpe:2.3:a:ibm:integration_bus:9.0:*:*:*:*:*:*:*
ibmintegration_bus10.0cpe:2.3:a:ibm:integration_bus:10.0:*:*:*:*:*:*:*
ibmwebsphere_message_broker8.0cpe:2.3:a:ibm:websphere_message_broker:8.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	integration_bus	9.0	cpe:2.3:a:ibm:integration_bus:9.0:::::::*
ibm	integration_bus	10.0	cpe:2.3:a:ibm:integration_bus:10.0:::::::*
ibm	websphere_message_broker	8.0	cpe:2.3:a:ibm:websphere_message_broker:8.0:::::::*

CNA Affected

[
  {
    "product": "Integration Bus",
    "vendor": "IBM Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "9.0.0.0"
      },
      {
        "status": "affected",
        "version": "9.0"
      },
      {
        "status": "affected",
        "version": "10"
      },
      {
        "status": "affected",
        "version": "10.0"
      },
      {
        "status": "affected",
        "version": "9"
      }
    ]
  }
]

References

www.ibm.com/support/docview.wss?uid=swg21997918

www.securityfocus.com/bid/96274

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:P/I:N/A:C

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

AI Score

9.2

Confidence

High

EPSS

0.003

Percentile

68.0%

JSON

Related for CVE-2016-9706