HIGH
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data
Published Aug 20, 2019
8.2
HIGHCVSS 3.1
EPSS 2.43%
Description
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162770.
Affected products
-
Affected
- 18.0.0.0
- 18.0.0.1
- 18.0.0.2
- 19.0.0.1
- 19.0.0.2
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| IBM | Business Automation Workflow | unknown | Affected
|
OR
- ≥ 18.0.0.0 · ≤ 19.0.0.2
- ≥ 7.5.0.0 · ≤ 7.5.1.2
- ≥ 8.0.0.0 · ≤ 8.0.1.3
- ≥ 8.5.0.0 · ≤ 8.5.0.2
- 8.5.5.0
- 8.5.6.0
- 8.5.6.0
- 8.5.6.0
- 8.5.7.0
- 8.5.7.0
- 8.5.7.0
- 8.5.7.0
- 8.5.7.0
- 8.5.7.0
- 8.6.0.0
- 8.6.0.0
- 8.6.0.0
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (3)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-14031 Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/162770 vdb-entryx_refsource_XFVDB EntryVendor Advisory
- https://www.ibm.com/support/docview.wss?uid=ibm10959537 x_refsource_CONFIRMVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-14031 | Advisory | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/162770 | vdb-entryx_refsource_XFVDB EntryVendor Advisory | |
| https://www.ibm.com/support/docview.wss?uid=ibm10959537 | x_refsource_CONFIRMVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner ibm
Published Aug 20, 2019
Updated Sep 17, 2024
Reserved Jan 3, 2019
Link CVE-2019-4424
CISA Vulnrichment
No data
Red Hat
No data
GitHub
No data