Risk | High |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2017-9096 |
CWE-ID | CWE-611 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
IBM Tivoli Network Manager (ITNM) Client/Desktop applications / Software for system administration |
Vendor | IBM Corporation |
Security Bulletin
This security bulletin contains one high risk vulnerability.
EUVDB-ID: #VU31399
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-9096
CWE-ID:
CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Tivoli Network Manager (ITNM): All versions
External linkshttp://www.ibm.com/support/pages/node/6985225
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.