CVE-2015-5038

High

Published: 03/01/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

IBM Connections versions 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 do not properly detect recursion during XML entity expansion. This allows remote attackers to cause a denial of service via a crafted XML document containing a large number of nested entity references.

Risk Assessment

Attackers can exploit this vulnerability to increase CPU consumption and crash the application, leading to service unavailability.

Recommendation

It is recommended to update IBM Connections to the latest version to mitigate this vulnerability and to monitor the system for unauthorized attack attempts.

Other vulnerabilities in IBM Connections

CVE-2016-3007High
CVE-2016-3007 describes a CSRF vulnerability in IBM Connections versions 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 that allows remote authenticated users to hijack the authentication of arbitrary users.

Original NVD description (English source)

IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 does not properly detect recursion during XML entity expansion, which allows remote attackers to cause a denial of service (CPU consumption and application crash) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.