CVE-2014-3087: Infoleak
callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3087?
CVE-2014-3087 has a severity rating that varies based on the specific deployment, but it is generally considered as high due to the ability of authenticated users to exploit the vulnerability.
How do I fix CVE-2014-3087?
To fix CVE-2014-3087, IBM recommends updating to the latest version of the Business Process Manager or applying the appropriate security patches provided for affected versions.
Who is affected by CVE-2014-3087?
CVE-2014-3087 affects users of IBM Business Process Manager versions 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5.
What type of vulnerability is CVE-2014-3087?
CVE-2014-3087 is an XML External Entity (XXE) vulnerability that allows for arbitrary file reading.
Can CVE-2014-3087 be exploited remotely?
Yes, CVE-2014-3087 can be exploited remotely by authenticated users, enabling them to read arbitrary files on the server.