CVE-2018-1542: XEE
First published: Fri Jul 06 2018(Updated: )
IBM FileNet Content Manager, IBM Content Foundation, and IBM Case Foundation Administration Console for Content Platform Engine (ACCE) 5.2.1 and 5.5.0 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 142597.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM FileNet Content Manager | =5.2.1 | |
| IBM FileNet Content Manager | =5.5.0 | |
| IBM Content Foundation | =5.2.1 | |
| IBM Content Foundation | =5.5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-1542?
CVE-2018-1542 is a vulnerability in IBM FileNet Content Manager, IBM Content Foundation, and IBM Case Foundation Administration Console for Content Platform Engine (ACCE) 5.2.1 and 5.5.0 that allows a remote attacker to exploit an XML External Entity Injection (XXE) vulnerability.
Which software versions are affected by CVE-2018-1542?
IBM FileNet Content Manager 5.2.1 and 5.5.0, IBM Content Foundation 5.2.1 and 5.5.0, and IBM Case Foundation Administration Console for Content Platform Engine (ACCE) 5.2.1 and 5.5.0 are affected by CVE-2018-1542.
What is the severity of CVE-2018-1542?
CVE-2018-1542 has a severity rating of 7.1 (high).
How can a remote attacker exploit CVE-2018-1542?
A remote attacker can exploit CVE-2018-1542 by performing an XML External Entity Injection (XXE) attack when processing XML data.
Are there any references or resources available for CVE-2018-1542?
Yes, here are some references for CVE-2018-1542: - [IBM Support](http://www.ibm.com/support/docview.wss?uid=swg22015943) - [SecurityTracker](http://www.securitytracker.com/id/1041225) - [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/vulnerabilities/142597)
- collector/nvd-index
- agent/type
- agent/remedy
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/softwarecombine
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/ibm
- canonical/ibm filenet content manager
- version/ibm filenet content manager/5.2.1
- version/ibm filenet content manager/5.5.0
- canonical/ibm content foundation
- version/ibm content foundation/5.2.1
- version/ibm content foundation/5.5.0