CVE-2017-1289
HighSummary
IBM SDK, Java Technology Edition is vulnerable to XML External Entity Injection (XXE) when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Risk Assessment
This vulnerability could lead to the exposure of confidential data and negatively impact system performance, posing a risk to the organization.
Recommendation
It is recommended to update IBM SDK to the latest version to mitigate this vulnerability and implement appropriate security measures when processing XML data.
Other vulnerabilities in IBM SDK, Java Technology Edition
See all- CVE-2016-0376High
The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition before SR16 FP25 improperly deserializes classes in an AccessController doPrivileged block, allowing remote attackers to bypass a sandbox protection mechanism and execute arbitrary code.
- CVE-2016-0363High
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25, 6 R1 before SR8 FP25, 7 before SR9 FP40, 7 R1 before SR3 FP40, and 8 before SR3 uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, allowing remote attackers to call setSecurityManager and bypass a sandbox protection mechanism.
- CVE-2014-8892High
An unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition allows remote attackers to bypass intended access permissions and obtain sensitive information.
- CVE-2014-8891High
An unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition allows remote attackers to escape the Java sandbox and execute arbitrary code.
Original NVD description (English source)
IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125150.