DATABASE RESOURCES PRICING ABOUT US

{"id": "6E0DF52D6E207CD02D195E58937C81EC0699E7612089765DAD506A00352E834A", "vendorId": null, "type": "ibm", "bulletinFamily": "software", "title": "Security Bulletin: There is a vulnerability in Apache SOAP used by IBM Maximo Asset Management (CVE-2022-40705)", "description": "## Summary\n\nThere is a vulnerability in Apache SOAP used by IBM Maximo Asset Management.\n\n## Vulnerability Details\n\n**CVEID: **[CVE-2022-40705](<https://vulners.com/cve/CVE-2022-40705>) \n**DESCRIPTION: **Apache SOAP is vulnerable to an XML external entity injection (XXE) attack when processing XML data, caused by a weakly configured XML parser in RPCRouterServlet. By using specially-crafted XML content in the configuration file, a remote attacker could exploit this vulnerability to read arbitrary files. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/236814](<https://exchange.xforce.ibmcloud.com/vulnerabilities/236814>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)\n\n## Affected Products and Versions\n\nThis vulnerability affects the following versions of the IBM Maximo Asset Management core product. The recommended action is to update to the latest version.\n\n**Product versions affected:**\n\nAffected Product(s) | Version(s) \n---|--- \nIBM Maximo Asset Management | 7.6.1.2 \nIBM Maximo Asset Management | 7.6.1.3 \n \n* To determine the core product version, log in and view System Information. The core product version is the \"Tivoli's process automation engine\" version. Please consult the [Platform Matrix](<https://www.ibm.com/support/pages/node/1288432> \"Platform Matrix\" ) for a list of supported product combinations.\n\n## Remediation/Fixes\n\nThe recommended solution is to download the appropriate Interim Fix or Fix Pack from Fix Central (What is Fix Central?) and apply for each affected product as soon as possible. Please see below for information on the fixes available for each product, version, and release. Follow the installation instructions in the \u2018readme\u2019 documentation provided with each fix pack or interim fix. \n\n**For Maximo Asset Management 7.6:**\n\nVRM | Fix Pack, Feature Pack, or Interim Fix | Download \n---|---|--- \n7.6.1.2 | \n\nMaximo Asset Management 7.6.1.2 iFix: \n[7.6.1.2-TIV-MBS-IF029](<https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7ETivoli&product=ibm/Tivoli/IBM+Maximo+Asset+Management&release=7.6.1.2&platform=All&function=fixId&fixids=7.6.1.2-TIV-MBS-IF029&includeRequisites=1&includeSupersedes=0&downloadMethod=http> \"7.6.1.2-TIV-MBS-IF029\" ) or latest Interim Fix available\n\n| [FixCentral](<https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7ETivoli&product=ibm/Tivoli/IBM+Maximo+Asset+Management&release=7.6.1.2&platform=All&function=all> \"FixCentral\" ) \n7.6.1.3 | \n\nMaximo Asset Management 7.6.1.3 iFix:\n\n[7.6.1.3-TIV-MBS-IF004](<https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7ETivoli&product=ibm/Tivoli/IBM+Maximo+Asset+Management&release=7.6.1.3&platform=All&function=fixId&fixids=7.6.1.3-TIV-MBS-IF004&includeRequisites=1&includeSupersedes=0&downloadMethod=http> \"7.6.1.3-TIV-MBS-IF004\" ) or latest Interim Fix available\n\n| [FixCentral](<https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7ETivoli&product=ibm/Tivoli/IBM+Maximo+Asset+Management&release=7.6.1.3&platform=All&function=all> \"FixCentral\" ) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "published": "2023-03-01T23:47:12", "modified": "2023-03-01T23:47:12", "epss": [{"cve": "CVE-2022-40705", "epss": 0.00316, "percentile": 0.66006, "modified": "2023-05-31"}], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0}, "severity": "MEDIUM", "exploitabilityScore": 10.0, "impactScore": 2.9, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}, "href": "https://www.ibm.com/support/pages/node/6959357", "reporter": "IBM", "references": [], "cvelist": ["CVE-2022-40705"], "immutableFields": [], "lastseen": "2023-05-31T17:40:33", "viewCount": 25, "enchantments": {"dependencies": {"references": [{"type": "cnvd", "idList": ["CNVD-2022-73694"]}, {"type": "cve", "idList": ["CVE-2022-40705"]}, {"type": "github", "idList": ["GHSA-JQ8C-J47C-VVWM"]}, {"type": "ibm", "idList": ["06FBD4D5E2F2CF4CA845EB7D845DF53D01619E2DDED68F08373FA140213E59E3"]}, {"type": "osv", "idList": ["OSV:GHSA-JQ8C-J47C-VVWM"]}, {"type": "veracode", "idList": ["VERACODE:37309"]}]}, "score": {"value": 7.4, "vector": "NONE"}, "affected_software": {"major_version": [{"name": "ibm maximo asset management", "version": 7}, {"name": "ibm maximo for aviation", "version": 7}, {"name": "ibm maximo for aviation", "version": 7}, {"name": "ibm maximo for aviation", "version": 7}, {"name": "maximo for life sciences", "version": 7}, {"name": "maximo for utilities", "version": 7}, {"name": "maximo for utilities", "version": 7}, {"name": "maximo spatial asset management", "version": 7}, {"name": "maximo spatial asset management", "version": 7}, {"name": "maximo spatial asset management", "version": 7}, {"name": "maximo spatial asset management", "version": 7}, {"name": "maximo for transportation", "version": 7}, {"name": "ibm control desk", "version": 7}, {"name": "ibm control desk", "version": 7}, {"name": "ibm maximo for service providers", "version": 7}, {"name": "ibm maximo for service providers", "version": 7}, {"name": "ibm maximo for service providers", "version": 7}, {"name": "maximo for nuclear power", "version": 7}, {"name": "maximo for oil and gas", "version": 7}, {"name": "maximo asset configuration manager", "version": 7}, {"name": "maximo asset configuration manager", "version": 7}, {"name": "maximo asset configuration manager", "version": 7}]}, "epss": [{"cve": "CVE-2022-40705", "epss": 0.00316, "percentile": 0.6589, "modified": "2023-05-02"}], "vulnersScore": 7.4}, "_state": {"dependencies": 1685578091, "score": 1685555021, "affected_software_major_version": 0, "epss": 0}, "_internal": {"score_hash": "9c6fe688a74ee2cebe987b6998b1acb2"}, "affectedSoftware": [{"version": "7.6.1", "operator": "eq", "name": "ibm maximo asset management"}, {"version": "7.6.8", "operator": "eq", "name": "ibm maximo for aviation"}, {"version": "7.6.7", "operator": "eq", "name": "ibm maximo for aviation"}, {"version": "7.6.6", "operator": "eq", "name": "ibm maximo for aviation"}, {"version": "7.6", "operator": "eq", "name": "maximo for life sciences"}, {"version": "7.6.0.2", "operator": "eq", "name": "maximo for utilities"}, {"version": "7.6.0.1", "operator": "eq", "name": "maximo for utilities"}, {"version": "7.6.0.5", "operator": "eq", "name": "maximo spatial asset management"}, {"version": "7.6.0.4", "operator": "eq", "name": "maximo spatial asset management"}, {"version": "7.6.0.3", "operator": "eq", "name": "maximo spatial asset management"}, {"version": "7.6.0.2", "operator": "eq", "name": "maximo spatial asset management"}, {"version": "7.6.2", "operator": "eq", "name": "maximo for transportation"}, {"version": "7.6.1.1", "operator": "eq", "name": "ibm control desk"}, {"version": "7.6.1", "operator": "eq", "name": "ibm control desk"}, {"version": "7.6.3.3", "operator": "eq", "name": "ibm maximo for service providers"}, {"version": "7.6.3.2", "operator": "eq", "name": "ibm maximo for service providers"}, {"version": "7.6.3.1", "operator": "eq", "name": "ibm maximo for service providers"}, {"version": "7.6.1", "operator": "eq", "name": "maximo for nuclear power"}, {"version": "7.6.1", "operator": "eq", "name": "maximo for oil and gas"}, {"version": "7.6.7.1", "operator": "eq", "name": "maximo asset configuration manager"}, {"version": "7.6.7", "operator": "eq", "name": "maximo asset configuration manager"}, {"version": "7.6.6", "operator": "eq", "name": "maximo asset configuration manager"}]}

{"cnvd": [{"lastseen": "2022-11-04T05:20:26", "description": "Apache SOAP is used as a client-side library by the Apache Foundation to invoke SOAP services available elsewhere, and as a server-side tool to implement SOAP-accessible services. parser in the RPCRouterServlet. An attacker could exploit this vulnerability to read arbitrary files.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-09-26T00:00:00", "type": "cnvd", "title": "Apache SOAP XML External Entity Injection Vulnerability", "bulletinFamily": "cnvd", "cvss2": {}, "cvelist": ["CVE-2022-40705"], "modified": "2022-11-04T00:00:00", "id": "CNVD-2022-73694", "href": "https://www.cnvd.org.cn/flaw/show/CNVD-2022-73694", "cvss": {"score": 0.0, "vector": "NONE"}}], "osv": [{"lastseen": "2023-04-11T01:36:01", "description": "An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-09-23T00:00:46", "type": "osv", "title": "Apache SOAP's RPCRouterServlet allows reading of arbitrary files over HTTP", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2022-40705"], "modified": "2023-04-11T01:35:56", "id": "OSV:GHSA-JQ8C-J47C-VVWM", "href": "https://osv.dev/vulnerability/GHSA-jq8c-j47c-vvwm", "cvss": {"score": 0.0, "vector": "NONE"}}], "github": [{"lastseen": "2023-05-31T17:12:33", "description": "An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-09-23T00:00:46", "type": "github", "title": "Apache SOAP's RPCRouterServlet allows reading of arbitrary files over HTTP", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-40705"], "modified": "2023-01-27T05:08:16", "id": "GHSA-JQ8C-J47C-VVWM", "href": "https://github.com/advisories/GHSA-jq8c-j47c-vvwm", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "ibm": [{"lastseen": "2023-05-31T17:40:28", "description": "## Summary\n\nThere is a security vulnerability in Apache SOAP used by IBM Maximo Manage application in IBM Maximo Application Suite.\n\n## Vulnerability Details\n\n**CVEID: **[CVE-2022-40705](<https://vulners.com/cve/CVE-2022-40705>) \n**DESCRIPTION: **Apache SOAP is vulnerable to an XML external entity injection (XXE) attack when processing XML data, caused by a weakly configured XML parser in RPCRouterServlet. By using specially-crafted XML content in the configuration file, a remote attacker could exploit this vulnerability to read arbitrary files. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/236814](<https://exchange.xforce.ibmcloud.com/vulnerabilities/236814>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)\n\n## Affected Products and Versions\n\n**Product versions affected:**\n\nAffected Product(s) | Version(s) \n---|--- \nMaximo Manage Application in IBM Maximo Application Suite | MAS 8.8-Manage 8.4 \n \n## Remediation/Fixes\n\n**For IBM Maximo Manage application in IBM Maximo Application Suite:**\n\nMAS | Manage Patch Fix or Release \n---|--- \n8.8 | 8.4.5 or latest (available from the Catalog under Update Available) \n8.9 | 8.5 or latest (available from the Catalog under Update Available) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2023-03-02T20:39:44", "type": "ibm", "title": "Security Bulletin: There is a security vulnerability in Apache SOAP used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2022-40705)", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-40705"], "modified": "2023-03-02T20:39:44", "id": "06FBD4D5E2F2CF4CA845EB7D845DF53D01619E2DDED68F08373FA140213E59E3", "href": "https://www.ibm.com/support/pages/node/6959359", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "veracode": [{"lastseen": "2023-05-31T20:03:36", "description": "soap is vulnerable to information disclosure. The vulnerability exists due to the lack of restrictions in the XML external entity reference of the library, allowing an attacker to read arbitrary files over HTTP\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-09-28T02:42:55", "type": "veracode", "title": "Information Disclosure", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-40705"], "modified": "2023-03-07T23:56:39", "id": "VERACODE:37309", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-37309/summary", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "cve": [{"lastseen": "2023-05-31T15:01:48", "description": "** UNSUPPORTED WHEN ASSIGNED ** An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-09-22T09:15:00", "type": "cve", "title": "CVE-2022-40705", "cwe": ["CWE-611"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-40705"], "modified": "2023-03-07T22:11:00", "cpe": ["cpe:/a:apache:soap:*"], "id": "CVE-2022-40705", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-40705", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:apache:soap:*:*:*:*:*:*:*:*"]}]}