Lucene search

K
nvd[email protected]NVD:CVE-2023-32327
HistoryFeb 03, 2024 - 1:15 a.m.

CVE-2023-32327

2024-02-0301:15:08
CWE-611
web.nvd.nist.gov
ibm security access manager
xml external entity injection
xxe attack
remote attacker
sensitive information
memory resources
ibm x-force id

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.0%

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 254783.

Affected configurations

NVD
Node
ibmsecurity_verify_accessRange10.0.0.010.0.6.1
OR
ibmsecurity_verify_access_dockerRange10.0.0.010.0.6.1

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.0%

Related for NVD:CVE-2023-32327