Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attacker due to the module xmldom [CVE-2022-39353]

Summary

IBM App Connect Enterprise is vulnerable to a remote attacker due to the module xmldom. [CVE-2022-39353] The resolving fix includes xmldom 0.8.5 and 0.8.6

Vulnerability Details

CVEID:CVE-2022-39353
**DESCRIPTION:**Node.js xmldom module could allow a remote attacker to bypass security restrictions, caused by the use of multiple top level elements. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass authentication and obtain administrative access.
CVSS Base score: 9.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239426 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerabilities now by applying the appropriate fix to IBM App Connect Enterprise

Product(s)

|

Version(s)

|

APAR

|

Remediation / Fix

—|—|—|—

IBM App Connect Enterprise

|

v12.0.1.0 - v12.0.6.0

|

IT42451

|

The APAR IT42451 is available in fix pack 12.0.7.0

IBM App Connect Enterprise - 12.0.7.0

Workarounds and Mitigations

None