XXE attack in Apache Foundation products - CVE-2017-15691

Vulnerability identifier: #VU12328

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-15691

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper restriction of XML External Entity (XXE) references. A remote attacker can trick the victim into opening a specially crafted XML document that submits malicious XML entities that are parsed by the XML parser, gain access to potentially sensitive information, such as local files or other internal information.

uimaDUCC
uimaFIT
uimaj
uima-as
IBM OmniFind Text Search Server for DB2 for i
IBM FileNet Content Manager
IBM Enterprise Content Management Text Search
CP4BA - Filenet Content Manager
Fuse

Update Apache uimaj to 2.10.2 or 3.0.0-beta, Apache uima-as to 2.10.2, Apache uimaFIT to 2.4.0, Apache uimaDUCC to 2.2.2.

IBM FileNet Content Manager - addressed in versions 5.5.8.0 IF008, 5.5.12.0 IF003, 5.6.0.0 IF001
IBM Enterprise Content Management Text Search - addressed in versions 5.5.8.0 IF008, 5.5.12.0 IF003, 5.6.0.0 IF001
Fuse - update to 7.3.1
CP4BA - Filenet Content Manager - addressed in versions 21.0.3 IF37, 22.0.3 IF6, 24.0.0 IF3

• https://uima.apache.org/security_report#CVE-2017-15691

• Information disclosure in Apache UIMA
• FileNet Content Manager (FNCM) Content Search Services (CSS)/Enterprise Content Management Text Search (ECMTS) update for Apache uimaj
• Multiple vulnerabilities in Fuse 7.3
• Multiple vulnerabilities in IBM OmniFind Text Search Server for DB2 for i