Security Bulletin: IBM UrbanCode Deploy (UCD) is vulnerable to XML external entity XXE due to Apache Ivy

Summary

Apache Ivy may be used by plugins or custom scripts in IBM UrbanCode Deploy (UCD). Apache Ivy is vulnerable to a XXE caused by improper handling of XML external entity (XXE) declarations by the XML parser. (CVE-2022-46751)

Vulnerability Details

CVEID:CVE-2022-46751
**DESCRIPTION:**Apache Ivy could allow a remote attacker to obtain sensitive information, caused by improper handling of XML external entity (XXE) declarations by the XML parser. By using a specially crafted XML content, a remote attacker could exploit this vulnerability to exfiltrate data, access resources only the machine running Ivy has access to or disturb the execution of Ivy.
CVSS Base score: 8.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/264003 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

IBM strongly suggests the following:

Upgrade to any of 7.0.5.18, 7.1.2.14, 7.2.3.7, or 7.3.2.2 or later

Workarounds and Mitigations

None