CVE-2018-1845: XEE
First published: Mon Jun 17 2019(Updated: )
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150905.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ibm Infosphere Information Server | =11.3 | |
| Ibm Infosphere Information Server | =11.5 | |
| Ibm Infosphere Information Server | =11.7 | |
| IBM AIX | ||
| Linux Linux kernel | ||
| Microsoft Windows | ||
| Ibm Infosphere Governance Catalog | =11.3 | |
| Ibm Infosphere Governance Catalog | =11.5 | |
| Ibm Infosphere Governance Catalog | =11.7 | |
| Ibm Infosphere Information Server On Cloud | =11.5 | |
| Ibm Infosphere Information Server On Cloud | =11.7 | |
| Ibm Infosphere Information Server Business Glossary | =9.1 | |
| IBM InfoSphere Information Server Metadata Workbench | =9.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2018-1845.
What is the severity of this vulnerability?
The severity of this vulnerability is high with a severity value of 7.1.
Which software versions are affected by this vulnerability?
IBM InfoSphere Information Server versions 11.3, 11.5, and 11.7 are affected by this vulnerability.
What is the impact of this vulnerability?
This vulnerability could be exploited by a remote attacker to expose sensitive information or consume memory resources.
Is there a fix available for this vulnerability?
Yes, IBM has released a fix for this vulnerability. Please refer to the IBM Security Bulletin for more information.
- collector/nvd-index
- agent/type
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/description
- agent/event
- agent/softwarecombine
- agent/last-modified-date
- agent/remedy
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/ibm
- canonical/ibm infosphere information server
- version/ibm infosphere information server/11.3
- version/ibm infosphere information server/11.5
- version/ibm infosphere information server/11.7
- canonical/ibm aix
- vendor/linux
- canonical/linux linux kernel
- vendor/microsoft
- canonical/microsoft windows
- canonical/ibm infosphere governance catalog
- version/ibm infosphere governance catalog/11.3
- version/ibm infosphere governance catalog/11.5
- version/ibm infosphere governance catalog/11.7
- canonical/ibm infosphere information server on cloud
- version/ibm infosphere information server on cloud/11.5
- version/ibm infosphere information server on cloud/11.7
- canonical/ibm infosphere information server business glossary
- version/ibm infosphere information server business glossary/9.1
- canonical/ibm infosphere information server metadata workbench
- version/ibm infosphere information server metadata workbench/9.1