IBM80F99FC63CD8FBF964CB5F63FF68AF6367926397E47E5988D081763C23D104A6Security Bulletin: IBM Financial Transaction Manager is vulnerable to an XML External Entity Injection (XXE) attack
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
6.5 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
30.5%
Summary
IBM Financial Transaction Manager for ACH and Check Service v3.0.5.4 and v3.0.5.5 has addressed an XML External Entity Injection vulnerability.
Vulnerability Details
CVEID:CVE-2023-35892
**DESCRIPTION:**IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 258786.
CVSS Base score: 7.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/258786 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| Financial Transaction Manager for ACH Services and Check Services | 3.0.5.4 - 3.0.5.4 iFix 23 |
| Financial Transaction Manager for ACH Services and Check Services | 3.0.5.5 - 3.0.5.5 iFix 5 |
Remediation/Fixes
IBM strongly recommends addressing the vulnerability now.
| Affected Product | Resolved by VRMF | Remediation / First Fix |
|---|---|---|
| Financial Transaction Manager for ACH Services and Check Services | 3.0.5.4 iFix 24 | FTM ACH and Check 3.0.5.4 iFix 24 |
| Financial Transaction Manager for ACH Services and Check Services | 3.0.5.5 iFix 6 | FTM ACH and Check 3.0.5.5 iFix 6 |
Workarounds and Mitigations
None
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm financial transaction manager | eq | 3.0.5.4 | |
| ibm financial transaction manager | eq | 3.0.5.5 |
Related
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
6.5 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
30.5%