CVE-2016-5971
HighSummary
IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance version 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive data and denial of service attacks, potentially leading to system downtime.
Recommendation
It is recommended to upgrade to version 2.0.2 FP8 or later to mitigate this vulnerability and implement appropriate safeguards against XXE attacks.
Other vulnerabilities in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance
See all- CVE-2016-5963High
IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 does not properly validate updates, allowing remote authenticated users to execute arbitrary code via unspecified vectors.
- CVE-2016-5957High
IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 contains a weak algorithm that allows remote attackers to defeat cryptographic protection mechanisms and obtain sensitive information.
Original NVD description (English source)
IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.