CVE-2021-20492

🗓️ 26 May 2021 16:20:18Reported by ibmType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 118 Views

IBM WebSphere App Server 8.0, 8.5, 9.0, and Liberty Java Batch vulnerable to XML External Entity Injection (XXE) attack

Reporter	Title	Published	Views	Family All 46
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Rational ClearCase (CVE-2021-20492, CVE-2021-29754, CVE-2021-29736, CVE-2015-5262, CVE-2014-3577, CVE-2012-6153, CVE-2011-1498)	16 Sep 202106:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM WebSphere Appilcation Server and WebSphere Application Server Liberty affects IBM Engineering ELM products on IBM Jazz technology.	1 Jun 202115:41	–	ibm
IBM Security Bulletins	Security Bulletin: Using components with known vulnerabilities in IBM Security Guardium Key Lifecycle Manager (CVE-2021-20492)	12 Nov 202106:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in WebSphere Application Server affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise	21 Sep 202109:48	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server, which is a required product for IBM Tivoli Netcool Configuration Manager (CVE-2021-20492)	28 Jun 202113:29	–	ibm
IBM Security Bulletins	Security Bulletin: Watson Knowledge Catalog InstaScan is vulnerable to an XML External Entity (XXE) Injection vulnerability due to IBM WebSphere Application Server Liberty ( CVE-2021-20492 )	11 Aug 202204:50	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Security Identity Manager	8 Jun 202122:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Liberty profile shipped with IBM Robotic Process Automation	18 Jul 202221:58	–	ibm
IBM Security Bulletins	Security Bulletin: WebSphere Application Server Java Batch shipped with IBM Security Access Manager for Enterprise Single Sign-On is vulnerable to an XML External Entity Injection (XXE) vulnerability (CVE-2021-20492)	31 May 202104:34	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Remote Server (CVE-2021-20492)	2 Jun 202119:47	–	ibm

NVD

Vulners

Node

ibm websphere_application_serverRange8.0.0.0–8.0.0.15

ibm websphere_application_serverRange8.5.0.0–8.5.5.19

ibm websphere_application_serverRange9.0.0.0–9.0.5.7

ibm websphere_application_serverRange17.0.0.3–21.0.0.5liberty

[
  {
    "product": "WebSphere Application Server",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "8.0"
      },
      {
        "status": "affected",
        "version": "8.5"
      },
      {
        "status": "affected",
        "version": "9.0"
      },
      {
        "status": "affected",
        "version": "Liberty"
      }
    ]
  }
]

Source	Link
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/197793
ibm	www.ibm.com/support/pages/node/6456017

21 Nov 2024 05:46Current

8High risk

Vulners AI Score8

CVSS 26.4

CVSS 3.18.2

CVSS 36.5

EPSS0.00304

CWE-611