#VU13606 XXE attack in IBM Content Foundation and IBM FileNet Content Manager - CVE-2018-1542
Published: July 9, 2018
Vulnerability identifier: #VU13606
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-1542
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
IBM Content Foundation
IBM FileNet Content Manager
IBM Content Foundation
IBM FileNet Content Manager
Software vendor:
IBM Corporation
IBM Corporation
Description
The disclosed vulnerability allows a remote authenticated attacker to perform XXE attack.
The weakness exists due to an error when processing malicious XML data. A remote attacker can supply specially crafted XML External Entity (XXE) data to the target Administration Console for Content Platform Engine (ACCE) interface component to read files with elevated privileges or consume excessive memory and cause the service to crash.
Remediation
The vulnerability is addressed in the versions 5.2.1.7, 5.5.1.