CVE-2016-8980 - IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data

Back Back to CVE browser

HIGH

IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data

Published Feb 1, 2017

8.1

HIGH

CVSS 3.0

EPSS 1.52%

Description

IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources.

Affected products

Vendor IBM Corporation Product BigFix Inventory Default
n/a
- Version
  9.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM Corporation

BigFix Inventory

n/a

Version	Status	Constraints
9.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

References (2)

http://www.ibm.com/support/docview.wss?uid=swg21995013
x_refsource_CONFIRMVendor Advisory
http://www.securityfocus.com/bid/95141
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry

Link	Providers	Tags
http://www.ibm.com/support/docview.wss?uid=swg21995013		x_refsource_CONFIRMVendor Advisory
http://www.securityfocus.com/bid/95141		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Feb 1, 2017

Updated Aug 6, 2024

Reserved Oct 25, 2016

Link CVE-2016-8980

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2016-8980

Red Hat

Severity n/a

Public date n/a

Links CVE-2016-8980