PT-2024-10052 · Ibm · Ibm Websphere Application Server +1

🗓️ 16 Apr 2024 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 1 Views

IBM WebSphere versions 8.5 and 9.0, and Liberty 17.0.0.3–24.0.0.5, restrict external XML entities improperly.

Reporter	Title	Published	Views	Family All 89
IBM Security Bulletins	Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to XML External Entity Injection attack due to IBM WebSphere Application Server Liberty (CVE-2024-22354)	1 Jul 202415:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable to an XML External Entity (XXE) injection vulnerability (CVE-2024-22354)	19 Apr 202411:15	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Business Monitor	20 Nov 202414:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Transformation Extender Advanced v10.0.x is affected by a IBM WebSphere Application Server Liberty vulnerability	19 Sep 202411:09	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities in Liberty affect IBM Voice Gateway	17 May 202413:55	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of IBM Websphere Application Server Liberty, IBM CICS TX Standard is vulnerable to Denial of Service, Weaker than exected security, Cross-site scripting and Server-side request forgery (SSRF).	9 May 202409:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are vulnerable to an XML External Entity (XXE) injection vulnerability (CVE-2024-22354)	17 Apr 202419:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities were discovered in IBM Verify Identity Governance	6 Feb 202506:16	–	ibm
IBM Security Bulletins	Security Bulletin: Updating IBM WebSphere Liberty Profile in Identity Insight for security update	19 May 202614:43	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilites in the IBM WebSphere Application Server Liberty version 17.0.0.3 - 24.0.0.5 affects Watson Machine Learning Accelerator on Cloud Pak for Data	3 Feb 202516:26	–	ibm

Source	Link
safe-surf	www.safe-surf.ru/specialists/bulletins-nkcki/709451
bdu	www.bdu.fstec.ru/vul/2025-00190
ibm	www.ibm.com/support/pages/node/7148426
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-22354
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
twitter	www.twitter.com/knaepp/status/1780280257955639640
twitter	www.twitter.com/bluepatch0404/status/1808533564084088900
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/280401
twitter	www.twitter.com/CVEnew/status/1780416378031452568
t	www.t.me/cvenotify/80607

03 Jul 2024 00:00Current

7.8High risk

Vulners AI Score7.8

CVSS 3.17

EPSS0.00019

SSVC

websphere application server liberty versions external xml entities server side forgery