CVE-2016-9691

HIGH

IBM WebSphere Cast Iron Solution 7.0.0-7.5.0.0 - XML External Entity Injection

Title source: llm
STIX 2.1

Description

IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM X-Force ID: 119515.

References (2)

Core 2
Core References
Broken Link vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/98338
Patch, Vendor Advisory x_refsource_confirm
http://www.ibm.com/support/docview.wss?uid=swg21998014

Scores

CVSS v3 8.6
EPSS 0.0035
EPSS Percentile 57.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Details

CWE
CWE-611
Status published
Products (7)
ibm/websphere_cast_iron_solution 7.0.0
ibm/websphere_cast_iron_solution 7.0.0.1
ibm/websphere_cast_iron_solution 7.0.0.2
ibm/websphere_cast_iron_solution 7.5.0.0
ibm/websphere_cast_iron_solution 7.5.0.1
ibm/websphere_cast_iron_solution 7.5.1.0
IBM Corporation/WebSphere Cast Iron Cloud integration 7.0.0. 7.5.0.0
Published May 05, 2017
Tracked Since Feb 18, 2026