XML External Entity injection in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - CVE-2024-22354

Vulnerability identifier: #VU88802

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-22354

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

IBM WebSphere Application Server
IBM WebSphere Application Server Liberty
IBM Business Automation Workflow
IBM Tivoli System Automation Application Manager
Engineering Workflow Management
IBM Rational ClearCase
Jazz for Service Management
Log Analysis
IBM Operations Analytics Predictive Insights
IBM Intelligent Operations Center
IBM MQ Operator
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM SPSS Analytic Server
IBM Sterling B2B Integrator
IBM Tivoli Netcool Impact
IBM Spectrum Symphony
IBM Maximo Asset Management
WebSphere Remote Server
WebSphere Service Registry and Repository
IBM Maximo Application Suite
IBM Rational ClearQuest
CICS Transaction Gateway
IBM Transformation Extender Advanced
IBM Security Verify Governance
InfoSphere Master Data Management
IBM Cloud Application Business Insights
IBM Cloud Transformation Advisor
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Match 360
IBM Spectrum Control
IBM Tivoli Monitoring
IBM Cloud Application Performance Management (APM)
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite - Manage Component
IBM Common Licensing
IBM TXSeries for Multiplatforms
IBM MQ
IBM Security Verify Governance - Containerized Identity Manager
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
Jazz Foundation
IBM CICS TX Advanced
IBM CICS TX Standard
IBM Engineering Requirements Management DOORS Next
Engineering Test Management
Answer Retrieval for Watson Discovery On Prem
Intelligent Operations Center for Emergency Management
Tivoli Composite Application Manager for Application Diagnostics
IBM OpenPages with Watson
Business Monitor
DevOps
PowerVM NovaLink
IBM Planning Analytics Workspace
IBM Watson Machine Learning Accelerator
Storage Protect Backup-Archive Client
Storage Protect for Virtual Environments: Data Protection for VMware
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Storage Protect for Space Management
Storage Protect Operations Center
Maximo Application Suite - Monitor Component
Maximo Application Suite - Predict Component
IBM MQ Appliance
IBM Workload Automation
Robotic Process Automation for Cloud Pak
Business Automation Insights
IBM Tivoli Application Dependency Discovery Manager
IBM Watson Explorer Analytical Components
IBM Watson Explorer Foundational Components
IBM Watson Explorer Deep Analytics Edition Analytical Components
IBM Watson Explorer Deep Analytics Edition Foundational Components
IBM Cognos Controller
Financial Transaction Manager
IBM License Metric Tool
Voice Gateway
Planning Analytics Local
IBM Cognos Analytics
IBM Cloud Pak System
IBM Storage Scale System
IBM InfoSphere Information Server

Install updates from vendor's website.

IBM WebSphere Application Server - addressed in versions 8.5.5.26, 9.0.5.20
IBM WebSphere Application Server Liberty - update to 24.0.0.5
Answer Retrieval for Watson Discovery On Prem - update to 2.18.0
IBM MQ Operator - addressed in versions 9.3.0.20-r1, 9.4.0.0-r2
IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
IBM Tivoli Netcool Impact - update to 7.1.0.34
IBM Spectrum Symphony - update to 7.3.2 FP3
IBM Maximo Application Suite - addressed in versions 8.10.16, 8.11.13, 9.0.1
IBM Watson Explorer Analytical Components - update to 11.0.2.19
IBM Watson Explorer Foundational Components - update to 11.0.2.19
IBM Cognos Controller - update to 11.0.1.0.3
IBM Watson Explorer Deep Analytics Edition Analytical Components - update to 12.0.3.15
IBM Watson Explorer Deep Analytics Edition Foundational Components - update to 12.0.3.15
Voice Gateway - addressed in versions 1.0.8.12, 1.0.8.15
IBM Cloud Application Business Insights - addressed in versions 1.1.7.10, 1.1.8.5
PowerVM NovaLink - addressed in versions 2.0.3.1-240625, 2.1.1-240625, 2.2.1-240626
Planning Analytics Local - update to 2.0.9.20
IBM Planning Analytics Workspace - update to 2.1.4
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
IBM Cloud Transformation Advisor - update to 3.10.0
Financial Transaction Manager - update to 4.0.6.0 iFix4
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.6
IBM Watson Machine Learning Accelerator - update to 5.0.1
IBM Match 360 - update to 5.0.3
IBM Storage Scale System - addressed in versions 5.1.9.5, 5.2.1.0
IBM Spectrum Control - update to 5.4.12.1
IBM Tivoli Monitoring - update to 6.3.0.7 Plus Service Pack 5
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.17
Storage Protect Backup-Archive Client - update to 8.1.24
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.1.24.0
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.1.24.0
Storage Protect for Space Management - update to 8.1.24.0
Storage Protect Operations Center - update to 8.1.24
IBM SPSS Collaboration and Deployment Services - update to 8.5.0.0.14
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.17, 8.7.11
Maximo Application Suite - Monitor Component - addressed in versions 8.10.12, 8.11.9, 9.0.0
Maximo Application Suite - Predict Component - update to 9.0.0
IBM Common Licensing - update to 9.0.0.1
IBM TXSeries for Multiplatforms - update to 9.1.0.3
IBM MQ - addressed in versions 9.1.0.22, 9.2.0.26, 9.3.0.20, 9.4
IBM License Metric Tool - update to 9.2.36
IBM MQ Appliance - addressed in versions 9.3.0.20, 9.3.5.2
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix26, 11.1.0.0 ifix19
IBM Workload Automation - addressed in versions 10.1.0.5, 10.2.3
IBM Security Verify Governance - Containerized Identity Manager - update to 11.0.0.0
IBM CICS TX Standard - update to 11.1.0.0 ifix19
IBM Cognos Analytics - addressed in versions 11.2.4 IF5, 12.0.4 IF2
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF035, 24.0.0-IF001
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.18, 23.0.18
IBM Robotic Process Automation - addressed in versions 21.0.7.18, 23.0.18
Business Automation Insights - update to 23.0.2.0.6

• https://www.ibm.com/support/pages/node/7148426
• https://exchange.xforce.ibmcloud.com/vulnerabilities/280401

• Multiple vulnerabilities in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty
• XML external entity injection in IBM Security Guardium Key Lifecycle Manager
• Multiple vulnerabilities in IBM CICS TX Standard
• Multiple vulnerabilities in IBM CICS TX Advanced
• Multiple vulnerabilities in IBM TXSeries for Multiplatforms
• Multiple vulnerabilities in IBM Operations Analytics Predictive Insights
• XML External Entity injection in IBM Engineering Lifecycle Engineering product
• XML external entity injection in IBM Log Analysis
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM Security Verify Governance, Identity Manager
• XML external entity injection in IBM Tivoli System Automation Application Manager
• XML external entity injection in IBM WebSphere Remote Server
• XML external entity injection in IBM Intelligent Operations Center
• XML external entity injection in IBM Rational ClearQuest
• Multiple vulnerabilities in IBM Rational ClearCase and IBM DevOps Code ClearCase
• Multiple vulnerabilities in IBM WebSphere Service Registry and Repository
• XML external entity injection in Tivoli Composite Application Manager for Application Diagnostics
• XML external entity injection in IBM Business Automation Workflow
• XML external entity injection in IBM Jazz for Service Management
• Multiple vulnerabilities in IBM License Metric Tool
• Multiple vulnerabilities in IBM MQ
• Multiple vulnerabilities in IBM MQ Appliance
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Tivoli Monitoring
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• XML external entity injection in IBM Tivoli Netcool Impact
• Multiple vulnerabilities in IBM Tivoli Application Dependency Discovery Manager
• XML external entity injection in InfoSphere Master Data Management
• XML external entity injection in IBM Maximo Application Suite - Predict Component
• Multiple vulnerabilities in IBM Watson Explorer
• XML external entity injection in IBM PowerVM Novalink
• IBM Maximo Application Suite update for WebSphere Application Server
• XML external entity injection in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in IBM Common Licensing
• Multiple vulnerabilities in IBM OpenPages with Watson
• XML external entity injection in IBM Maximo Asset Management
• Multiple vulnerabilities in Planning Analytics Local
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Multiple vulnerabilities in IBM Watson Discovery for IBM Cloud Pak for Data
• Multiple vulnerabilities in CICS Transaction Gateway
• Multiple vulnerabilities in IBM Storage Scale
• XML external entity injection in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• XML external entity injection in IBM Transformation Extender Advanced
• Multiple vulnerabilities in IBM Cloud Application Business Insights
• XML external entity injection in IBM Match 360
• XML external entity injection in IBM Spectrum Control
• Multiple vulnerabilities in IBM Robotic Process Automation
• IBM Storage Protect Operations Center update for IBM WebSphere Application Server Liberty
• Multiple vulnerabilities in IBM Storage Protect for Space Management
• Multiple vulnerabilities in IBM Storage Protect for Virtual Environments: Data Protection for Microsoft Hyper-V
• XML external entity injection in IBM InfoSphere Information Server
• XML external entity injection in IBM SPSS Collaboration and Deployment Services
• IBM Sterling B2B Integrator update for WebSphere Application Server
• Multiple vulnerabilities in IBM Business Monitor
• XML external entity injection in IBM SPSS Analytic Server
• XML external entity injection in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift
• Multiple vulnerabilities in IBM Storage Protect for Virtual Environments: Data Protection for VMware
• Multiple vulnerabilities in IBM Cognos Controller
• XML external entity injection in IBM Workload Automation
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM Security Verify Governance Identity Manager Container
• Multiple vulnerabilities in IBM Cloud Application Performance Management (APM)
• Multiple vulnerabilities in IBM Storage Protect Backup-Archive Client
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in IBM Answer Retrieval for Watson Discovery
• Multiple vulnerabilities in IBM Spectrum Symphony