CVE-2016-3055
HIGHIBM FileNet Workplace 4.0.2 - Authenticated XML External Entity Injection
Title source: llmDescription
IBM FileNet Workplace 4.0.2 before 4.0.2.14 LA012 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/92411
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21987128
Scores
CVSS v3
8.1
EPSS
0.0139
EPSS Percentile
68.7%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Details
CWE
CWE-611
Status
published
Products (1)
ibm/filenet_workplace
4.0.2
Published
Dec 01, 2016
Tracked Since
Feb 18, 2026