IBMB439ED893EB4CE954BF190974F19621A42A4A0250549810A9B4136239F0E1BD0Security Bulletin: Apache XMLBeans XML Entity Expansion security vulnerability in IBM FileNet Content Manager
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
0.004 Low
EPSS
Percentile
69.8%
Summary
IBM FileNet Content Manager has XML Entity Expansion security vulnerabilties with Apache XMLBeans.
Vulnerability Details
CVEID:CVE-2021-23926
**DESCRIPTION:**Apache XMLBeans is vulnerable to a denial of service, caused by an XML external entity (XXE) error when processing XML data. By sending a specially-crafted XML request, a remote attacker could exploit this vulnerability to cause a denial of service or obtain sensitive information.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/194818 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| FileNet Content Manager | 5.5.4 |
| FileNet Content Manager | 5.5.6 |
| FileNet Content Manager | 5.5.7 |
Remediation/Fixes
Upgrade to one of the below releases:
| Product | ** VRMF** | ** APAR** | ** Remediation/First Fix** |
|---|---|---|---|
| FileNet Content Manager | 5.5.4 | ||
| 5.5.6 | |||
| 5.5.7 | PJ46646 | ||
| PJ46646 | |||
| PJ46646 | 5.5.4.0-P8CPE-IF007 - 1/14/2022 | ||
| 5.5.6.0-P8CPE-IF003 - 1/14/2022 | |||
| 5.5.7.0-P8CPE-IF002 - 1/14/2022 |
Only versions covered by continuous support for fixes are listed. Please apply the listed update to remediate.
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| filenet content manager | eq | 5.5.4 | |
| filenet content manager | eq | 5.5.6 | |
| filenet content manager | eq | 5.5.7 |
Related
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
0.004 Low
EPSS
Percentile
69.8%