CVE-2018-1456

Опубликовано: 06 июн. 2018

Источник: nvd

CVSS3: 7.1

CVSS2: 5.5

EPSS Низкий

Описание

IBM Rhapsody DM 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 140091.

Ссылки

http://www.ibm.com/support/docview.wss?uid=swg22016795
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/140091
VDB Entry
Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22016795
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/140091
VDB Entry
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:rational_rhapsody_design_manager:5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:rational_rhapsody_design_manager:5.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:rational_rhapsody_design_manager:5.0.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:rational_rhapsody_design_manager:6.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:rational_rhapsody_design_manager:6.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:rational_rhapsody_design_manager:6.0.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:rational_rhapsody_design_manager:6.0.3:*:*:*:*:*:*:*

cpe:2.3:a:ibm:rational_rhapsody_design_manager:6.0.4:*:*:*:*:*:*:*

cpe:2.3:a:ibm:rational_rhapsody_design_manager:6.0.5:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:ibm:rational_software_architect_design_manager:5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:rational_software_architect_design_manager:5.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:rational_software_architect_design_manager:5.0.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:rational_software_architect_design_manager:6.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:rational_software_architect_design_manager:6.0.1:*:*:*:*:*:*:*

EPSS

Процентиль: 37%

0.00164

Низкий

7.1 High

CVSS3

5.5 Medium

CVSS2

Дефекты

CWE-611

Связанные уязвимости

GHSA-mfh5-wqqv-jp8q