Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM797A27D3EACA010CCE86479C901BC052B4996ED792FF307C263904F77DFE1C17
HistoryApr 17, 2024 - 7:29 p.m.

Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are vulnerable to an XML External Entity (XXE) injection vulnerability (CVE-2024-22354)

2024-04-1719:29:03
www.ibm.com
13
ibm
websphere
xxe injection
vulnerability
xml
interim fix
apar ph59682

7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Summary

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are vulnerable to an XML External Entity (XXE) injection vulnerability.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s) and Version(s) Affecting Product(s) and Version(s) Affecting Product(s) and Version(s)

IBM WebSphere Hybrid Edition

  • 5.1
    |

IBM WebSphere Application Server Liberty

  • 17.0.0.3 - 24.0.0.3
    |

IBM WebSphere Application Server

  • 9.0
  • 8.5

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the APAR PH59682 as described in Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to an XML External Entity (XXE) injection vulnerability (CVE-2024-22354)

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmwebsphere_portalMatch5.1
CPENameOperatorVersion
ibm websphere hybrid editioneq5.1

Related

ibm 23
cnvd 1
nessus 1
cve 1
cvelist 1
nvd 1
ibm
ibm
Security Bulletin: Vulnerabilities in IBM WebSphere Application Server and WebSphere Application Server Liberty affect IBM Watson Explorer (CVE-2024-22354)
2024-06-20 06:46:52
Security Bulletin: A security vulnerability has been identified in WebSphere Application Server and WebSphere Liberty shipped with IBM Security Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2024-22354)
2024-04-26 09:39:30
Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are vulnerable to an XML External Entity (XXE) injection vulnerability (CVE-2024-22354)
2024-04-17 19:25:52
cnvd
cnvd
IBM WebSphere Application Server and IBM WebSphere Application Server Liberty XML External Entity Injection Vulnerability
2024-04-17 00:00:00
nessus
nessus
IBM WebSphere Application Server 8.5.x < 8.5.5.26 / 9.x < 9.0.5.20 / Liberty 17.0.0.3 < 24.0.0.6 (7148426)
2024-04-16 00:00:00
cve
cve
CVE-2024-22354
2024-04-17 01:15:06
cvelist
cvelist
CVE-2024-22354 IBM WebSphere Application Server XML external entity injection
2024-04-17 01:07:58
nvd
nvd
CVE-2024-22354
2024-04-17 01:15:06

7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON
Related for 797A27D3EACA010CCE86479C901BC052B4996ED792FF307C263904F77DFE1C17
ibm23cnvd1nessus1cve1cvelist1nvd1