CVE-2018-2019: XEE

Published Jan 15, 2019

Updated

IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 155265.

Affected Software

13 affected components

IBM Security Identity Manager=6.0.0

IBM Security Identity Manager=6.0.0.0

IBM Security Identity Manager=6.0.0.1

IBM Security Identity Manager=6.0.0.2

IBM Security Identity Manager=6.0.0.3

IBM Security Identity Manager=6.0.0.4

IBM Security Identity Manager=6.0.0.5

IBM Security Identity Manager=6.0.0.6

IBM Security Identity Manager=6.0.0.10

IBM Security Identity Manager=6.0.0.14

IBM Security Identity Manager=6.0.0.18

IBM Security Identity Manager=6.0.0.19

IBM Security Identity Manager=6.0.0.20

Remediation

Patch Available

https://www.ibm.com/support/docview.wss?uid=ibm10794615

Event History

Jan 18, 2019

CVE Published

04:29 PM

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2018-2019.

What is the severity of CVE-2018-2019?

The severity of CVE-2018-2019 is high.

What software versions are affected by CVE-2018-2019?

IBM Security Identity Manager versions 6.0.0, 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.0.0.4, 6.0.0.5, 6.0.0.6, 6.0.0.10, 6.0.0.14, 6.0.0.18, 6.0.0.19, and 6.0.0.20 are affected by CVE-2018-2019.

How can an attacker exploit CVE-2018-2019?

An attacker can exploit CVE-2018-2019 by performing a XML External Entity Injection (XXE) attack when processing XML data.

What are the potential impacts of CVE-2018-2019?

The potential impacts of CVE-2018-2019 include exposing sensitive information or consuming memory resources.