CVE-2017-1477

High

Published: 13/11/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

IBM Security Access Manager Appliance version 9.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Risk Assessment

This vulnerability could lead to the exposure of confidential data and impact system performance, which may have serious consequences for the organization.

Recommendation

It is recommended to upgrade to the latest version of IBM Security Access Manager Appliance to mitigate the risks associated with this vulnerability.

Other vulnerabilities in IBM Security Access Manager Appliance 9.0.3

CVE-2017-1453High
IBM Security Access Manager Appliance version 9.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands.

Original NVD description (English source)

IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 128612.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS