CVE-2014-3087

IBM Business Process Manager 7.5-8.5.5 - Authenticated XML External Entity Injection via callService.do

Title source: llm
STIX 2.1

Description

callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/69264
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/94112
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1JR50616
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60757
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60755
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21679726
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60752

Scores

EPSS 0.0133
EPSS Percentile 67.7%

Details

CWE
CWE-200
Status published
Products (13)
ibm/business_process_manager 7.5.0.0
ibm/business_process_manager 7.5.0.1
ibm/business_process_manager 7.5.1.0
ibm/business_process_manager 7.5.1.1
ibm/business_process_manager 7.5.1.2
ibm/business_process_manager 8.0.0.0
ibm/business_process_manager 8.0.1.0
ibm/business_process_manager 8.0.1.1
ibm/business_process_manager 8.0.1.2
ibm/business_process_manager 8.5.0.0
... and 3 more
Published Aug 17, 2014
Tracked Since Feb 18, 2026