CVE-2014-3087

IBM BPM and WebSphere Lombardi Edition are affected by CVE-2014-3087 due to an XXE flaw in callService.do that allows remote authenticated users to read arbitrary files through crafted XML data. Affected: IBM BPM Express/Standard/Advanced 7.5.x, 8.0.x, 8.5.0, 8.5.5; WebSphere Lombardi Edition 7.2...

CVE-2014-3087: Exposure of Sensitive Information to an Unauthorized Actor

callService.do in IBM Business Process Manager BPM 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE...