Lucene search

[email protected]CVE-2017-1289

HistoryMay 22, 2017 - 8:29 p.m.

CVE-2017-1289

2017-05-2220:29:00

CWE-611

[email protected]

web.nvd.nist.gov

ibm

sdk

java technology edition

xxe injection

remote attacker

sensitive information

memory resources

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

8.6 High

AI Score

Confidence

High

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

0.002 Low

EPSS

Percentile

60.7%

JSON

IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125150.

VendorProductVersionCPE
ibmvisualage_for_java6.0cpe:2.3:a:ibm:visualage_for_java:6.0:*:*:*:*:*:*:*
ibmvisualage_for_java6.1cpe:2.3:a:ibm:visualage_for_java:6.1:*:*:*:*:*:*:*
ibmvisualage_for_java7.0cpe:2.3:a:ibm:visualage_for_java:7.0:*:*:*:*:*:*:*
ibmvisualage_for_java7.1cpe:2.3:a:ibm:visualage_for_java:7.1:*:*:*:*:*:*:*
ibmvisualage_for_java8.0cpe:2.3:a:ibm:visualage_for_java:8.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	visualage_for_java	6.0	cpe:2.3:a:ibm:visualage_for_java:6.0:::::::*
ibm	visualage_for_java	6.1	cpe:2.3:a:ibm:visualage_for_java:6.1:::::::*
ibm	visualage_for_java	7.0	cpe:2.3:a:ibm:visualage_for_java:7.0:::::::*
ibm	visualage_for_java	7.1	cpe:2.3:a:ibm:visualage_for_java:7.1:::::::*
ibm	visualage_for_java	8.0	cpe:2.3:a:ibm:visualage_for_java:8.0:::::::*