CVE-2016-0245: Medium severity ibm websphere portal vulnerability

Published Feb 29, 2016

Updated

The XML parser in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF10 allows remote authenticated users to read arbitrary files or cause a denial of service via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected Software

3 affected components

IBM WebSphere Portal=8.0.0.0

IBM WebSphere Portal=8.0.0.1

IBM WebSphere Portal=8.5.0.0

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21975358

Event History

Feb 29, 2016

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-0245?

CVE-2016-0245 has a medium severity rating, indicating that it poses a moderate risk to affected systems.

How do I fix CVE-2016-0245?

To address CVE-2016-0245, upgrade IBM WebSphere Portal to version 8.0.0.1 CF20 or 8.5.0.0 CF10 or later.

What types of attacks are possible with CVE-2016-0245?

CVE-2016-0245 allows attackers to read arbitrary files or cause a denial of service through XML External Entity (XXE) attacks.

Who is affected by CVE-2016-0245?

CVE-2016-0245 affects users of IBM WebSphere Portal versions 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF10.

Is remote access required for CVE-2016-0245 exploitation?

Yes, CVE-2016-0245 requires remote authenticated access to exploit the vulnerability.