Security Bulletin: Apache Standard Taglibs Vulnerability Affects IBM Sterling B2B Integrator (CVE-2015-0254)

2021-10-1413:14:50

www.ibm.com

ibm sterling b2b integrator

apache standard taglibs

vulnerability

cve-2015-0254

remote attacker

arbitrary code

xml external entity injection

xxe

cvss

it38514

version 6.0.0.0 - 6.0.3.4

version 6.1.0.0 - 6.1.0.3

remediation

fix central

EPSS

0.071

Percentile

94.1%

JSON

Summary

IBM Sterling B2B Integrator has addressed the security vulnerability.

Vulnerability Details

CVEID:CVE-2015-0254
**DESCRIPTION:**Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system, caused by an XML External Entity Injection (XXE) error when processing XML data. By sending specially-crafted XML data, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/101550 for the current score.
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Affected Products and Versions

Affected Product(s)	APAR(s)	Version(s)
IBM Sterling B2B Integrator	IT38514	6.0.0.0 - 6.0.3.4
IBM Sterling B2B Integrator	IT38514	6.1.0.0 - 6.1.0.3

Remediation/Fixes

Product & Version	Remediation & Fix
6.0.0.0 - 6.0.3.4	Apply IBM Sterling B2B Integrator version 6.0.3.5, or 6.1.1.0 on Fix Central
6.1.0.0 - 6.1.0.3	Apply IBM Sterling B2B Integrator version 6.1.1.0 on Fix Central