CVE-2016-0288

Опубликовано: 01 июн. 2016

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

IBM Security AppScan Standard 8.7.x, 8.8.x, and 9.x before 9.0.3.2 and Security AppScan Enterprise allow remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Комментарий

CWE-611: Improper Restriction of XML External Entity Reference ('XXE')

Ссылки

http://www-01.ibm.com/support/docview.wss?uid=swg21980055
Vendor Advisory
http://www.securitytracker.com/id/1035927
http://www-01.ibm.com/support/docview.wss?uid=swg21980055
Vendor Advisory
http://www.securitytracker.com/id/1035927

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:security_appscan:8.7.0.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:security_appscan:8.7.0.1:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:security_appscan:8.8.0.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:security_appscan:9.0.0.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:security_appscan:9.0.0.1:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:security_appscan:9.0.1.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:security_appscan:9.0.1.1:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:security_appscan:9.0.2.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:security_appscan:9.0.2.1:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:security_appscan:9.0.3.0:*:*:*:standard:*:*:*

cpe:2.3:a:ibm:security_appscan:9.0.3.1:*:*:*:standard:*:*:*

EPSS

Процентиль: 48%

0.00246

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-f5h4-33c9-4qj2