Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM0FE476B2A66F0DB92B79A0D08EFEF0EDC1E094B9EA11EF3C386F62C1C7075F03
HistoryApr 17, 2024 - 7:25 p.m.

Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are vulnerable to an XML External Entity (XXE) injection vulnerability (CVE-2024-22354)

2024-04-1719:25:52
www.ibm.com
15
ibm
cloud pak
applications
vulnerable
xml external entity
injection
security
bulletin
xxe
2024-22354

7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Summary

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are vulnerable to an XML External Entity (XXE) injection vulnerability.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s) and Version(s) Affecting Product(s) and Version(s) Affecting Product(s) and Version(s)

IBM Cloud Pak for Applications

  • 5.1
    |

IBM WebSphere Application Server Liberty

  • 17.0.0.3 - 24.0.0.3
    |

IBM WebSphere Application Server

  • 9.0
  • 8.5

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the APAR PH59682 as described in Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to an XML External Entity (XXE) injection vulnerability (CVE-2024-22354)

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmcloud_pak_for_applicationsMatch5.1
CPENameOperatorVersion
ibm cloud pak for applicationseq5.1

Related

ibm 26
cnvd 1
nessus 1
cvelist 1
nvd 1
cve 1
ibm
ibm
Security Bulletin: A security vulnerability has been identified in WebSphere® Application Server and IBM WebSphere Application Server Liberty shipped with IBM® Intelligent Operations Center (CVE-2024-22354)
2024-04-23 18:43:51
Security Bulletin: A security vulnerability has been identified in WebSphere Application Server and WebSphere Liberty shipped with IBM Security Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2024-22354)
2024-04-26 09:39:30
Security Bulletin: Vulnerabilities in IBM WebSphere Application Server and WebSphere Application Server Liberty affect IBM Watson Explorer (CVE-2024-22354)
2024-06-20 06:46:52
cnvd
cnvd
IBM WebSphere Application Server and IBM WebSphere Application Server Liberty XML External Entity Injection Vulnerability
2024-04-17 00:00:00
nessus
nessus
IBM WebSphere Application Server 8.5.x < 8.5.5.26 / 9.x < 9.0.5.20 / Liberty 17.0.0.3 < 24.0.0.6 (7148426)
2024-04-16 00:00:00
cvelist
cvelist
CVE-2024-22354 IBM WebSphere Application Server XML external entity injection
2024-04-17 01:07:58
nvd
nvd
CVE-2024-22354
2024-04-17 01:15:06
cve
cve
CVE-2024-22354
2024-04-17 01:15:06

7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON
Related for 0FE476B2A66F0DB92B79A0D08EFEF0EDC1E094B9EA11EF3C386F62C1C7075F03
ibm26cnvd1nessus1cvelist1nvd1cve1