CVE-2023-27554: IBM WebSphere Application Server XML external entity injection
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249185.
Other sources
IBM WebSphere Application Server is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249185.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-27554?
CVE-2023-27554 is a vulnerability in IBM WebSphere Application Server that allows for an XML External Entity Injection (XXE) attack, which can lead to the exposure of sensitive information or the consumption of memory resources.
How does the XML External Entity Injection (XXE) attack work?
The XML External Entity Injection (XXE) attack occurs when an attacker exploits a vulnerability to inject malicious XML entities into the application, allowing them to read sensitive data or consume system resources.
Which versions of IBM WebSphere Application Server are affected by CVE-2023-27554?
IBM WebSphere Application Server versions 8.5 and 9.0 are affected by CVE-2023-27554.
What is the severity of CVE-2023-27554?
CVE-2023-27554 has a severity rating of 9.1 (critical).
How can I mitigate the CVE-2023-27554 vulnerability in IBM WebSphere Application Server?
To mitigate the CVE-2023-27554 vulnerability, apply the necessary security patches provided by IBM, and ensure that the XML processing in the application is secure and properly configured.