SB2022100314 - XXE attack in IBM SPSS Statistics

Description

This security bulletin contains information about 1 vulnerability.

1) XXE attack (CVE-ID: CVE-2018-1000632)

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear

The vulnerability allows a remote attacker to conduct XXE attack on the target system.

The vulnerability exists due to improper sanitization of elements and attribute names in XML documents. A remote attacker can trick the victim into opening a specially crafted XML document that submits malicious input, perform XXE attack and bypass security restrictions to access and modify sensitive information on the system.

Remediation

Install update from vendor's website.

References

• https://www.ibm.com/blogs/psirt/security-bulletin-dom4j-vulnerability-affects-ibm-spss-statistics-cve-2018-1000632/
• https://www.ibm.com/support/pages/node/6620049