XXE attack in IBM WebSphere Application Server - CVE-2018-1905
Published: November 20, 2018 / Updated: November 29, 2018
Vulnerability identifier: #VU16175
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1905
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to conduct XXE-attack.
The vulnerability exists due to improper handling of XML External Entities (XXEs) when parsing an XML file. A remote attacker can trick the victim into open an XML file that submits malicious input and obtain potentially sensitive information or consume excessive resources to cause the server to crash.
Affected software
IBM WebSphere Application Server
How to mitigate CVE-2018-1905
Update to version 9.0.0.10.
IBM WebSphere Application Server - update to 9.0.0.10