CVE-2021-20454

🗓️ 21 Apr 2021 12:05:20Reported by ibmType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 72 Views

IBM WebSphere App Server 7.0-9.0 XML External Entity Injection vulnerabilit

Reporter	Title	Published	Views	Family All 44
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Security Key Lifecycle Manager (SKLM) (CVE-2021-20454)	26 Apr 202114:19	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM WebSphere Appilcation Server and WebSphere Application Server Liberty affects IBM Engineering ELM products on IBM Jazz technology.	1 Jun 202115:41	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in WebSphere Application Server affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise	17 Oct 202400:55	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2021-20454)	6 May 202113:55	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in embedded IBM WebSphere Application Server which is shipped with IBM Tivoli Netcool Configuration Manager (CVE-2021-20454)	28 Jun 202109:52	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Tivoli Access Manager for e-business	22 Apr 202114:10	–	ibm
IBM Security Bulletins	Security Bulletin: WebSphere Application Server is vulnerable to an XML External Entity (XXE) Injection vulnerability (CVE-2021-20454).	3 May 202109:03	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Intelligent Operations Center (CVE-2021-20454)	21 Apr 202109:51	–	ibm
IBM Security Bulletins	Security Bulletin: WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On is vulnerable to an XML External Entity (XXE) Injection vulnerability (CVE-2021-20454)	31 May 202104:33	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server, which is a required product for IBM Tivoli Netcool Configuration Manager (CVE-2021-20454)	28 Jun 202111:01	–	ibm

NVD

Vulners

Node

ibm websphere_application_serverRange7.0.0.0–7.0.0.45-

ibm websphere_application_serverRange8.0.0.0–8.0.0.15-

ibm websphere_application_serverRange8.5.0.0–8.5.5.19

ibm websphere_application_serverRange9.0.0.0–9.0.5.7

[
  {
    "product": "WebSphere Application Server",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "7.0"
      },
      {
        "status": "affected",
        "version": "8.0"
      },
      {
        "status": "affected",
        "version": "8.5"
      },
      {
        "status": "affected",
        "version": "9.0"
      }
    ]
  }
]

Source	Link
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/196649
ibm	www.ibm.com/support/pages/node/6445481

21 Nov 2024 05:46Current

8High risk

Vulners AI Score8

CVSS 26.4

CVSS 3.18.2

CVSS 38.2

EPSS0.00102

CWE-611