Security Bulletin: IBM Forms Experience Builder is vulnerable to XML External Entity (XXE) Processing (CVE-2016-0369)

Summary

IBM Forms Experience Builder is vulnerable to an XML External Entity processing exposure potentially leading to information disclosure.

Vulnerability Details

CVEID: CVE-2016-0369 DESCRIPTION: IBM Forms Experience Builder could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection (XXE) when processing XML data. By sending specially-crafted XML data, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base Score: 2.7
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/112088&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

IBM Forms Experience Builder 8.5
IBM Forms Experience Builder 8.5.1
IBM Forms Experience Builder 8.6

Remediation/Fixes

Product

| VRMF|APAR|Remediation
—|—|—|—
IBM Forms Experience Builder| 8.5.0.*| LO88448| To obtain the fix and installation assistance for these versions, contact IBM Support.
IBM Forms Experience Builder| 8.5.1| LO88448
IBM Forms Experience Builder| 8.6.0| LO88448| Download and Install 8.6.3

Workarounds and Mitigations

None