CVE-2016-0319

Опубликовано: 25 нояб. 2016

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

The XML parser in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote authenticated administrators to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Ссылки

http://www-01.ibm.com/support/docview.wss?uid=swg21983137
Patch
Vendor Advisory
http://www.securityfocus.com/bid/92475
Third Party Advisory
VDB Entry
http://www-01.ibm.com/support/docview.wss?uid=swg21983137
Patch
Vendor Advisory
http://www.securityfocus.com/bid/92475
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:jazz_reporting_service:6.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:jazz_reporting_service:6.0.1:*:*:*:*:*:*:*

EPSS

Процентиль: 67%

0.00547

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-284

Связанные уязвимости

GHSA-4f7p-mhh6-p6r7