CVE-2015-0133
IBM WebSphere Commerce 7.0 Feature Pack 4-8 - XML External Entity Injection
Title source: llmDescription
IBM WebSphere Commerce 7.0 Feature Pack 4 through 8 allows remote attackers to read arbitrary files and possibly obtain administrative privileges via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1031881
Various Sources vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1JR52499
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21696242
Scores
EPSS
0.0221
EPSS Percentile
80.7%
Details
Status
published
Products (1)
ibm/websphere_commerce
7.0
Published
Mar 13, 2015
Tracked Since
Feb 18, 2026