CVE-2014-3087

Published: Aug 17, 2014Modified: May 6, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected (13)

Products: Ibm: Business Process Manager, Websphere Application Server

Ibm

2 products

Business Process Manager

Websphere Application Server

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Ibm Business Process Manager	Version 7.5.0.0
Ibm Business Process Manager	Version 7.5.0.1
Ibm Business Process Manager	Version 7.5.1.0
Ibm Business Process Manager	Version 7.5.1.1
Ibm Business Process Manager	Version 7.5.1.2
Ibm Business Process Manager	Version 8.0.0.0
Ibm Business Process Manager	Version 8.0.1.0
Ibm Business Process Manager	Version 8.0.1.1
Ibm Business Process Manager	Version 8.0.1.2
Ibm Business Process Manager	Version 8.5.0.0
Ibm Business Process Manager	Version 8.5.0.1
Ibm Business Process Manager	Version 8.5.5.0
Ibm Websphere Application Server	Version 7.2