Lucene search
IbmCVELIST:CVE-2023-27874HistoryMar 21, 2023 - 2:33 p.m.
CVE-2023-27874 IBM Aspera Faspex XML external entity injection
2023-03-2114:33:20
CWE-611
ibm
www.cve.org
3
ibm aspera faspex
xml external entity injection
xxe attack
remote authenticated attacker
arbitrary commands
ibm x-force id 249845
CVSS3
9.9
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AI Score
9.2
Confidence
High
EPSS
0.001
Percentile
38.8%
IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "Aspera Faspex",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "4.4.2"
}
]
}
]Related
cnvd
cnvd
IBM Aspera XML External Entity Injection Vulnerability
2023-03-23 00:00:00
prion
prion
Xxe
2023-03-21 15:15:00
nvd
nvd
CVE-2023-27874
2023-03-21 15:15:12
cve
cve
CVE-2023-27874
2023-03-21 15:15:12
CVSS3
9.9
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AI Score
9.2
Confidence
High
EPSS
0.001
Percentile
38.8%
Related for CVELIST:CVE-2023-27874