CVE-2017-1758

Published: Feb 21, 2018Modified: Nov 21, 2024

7.1

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Exploitability: 2.8 / Impact: 4.2

Source: NVD

Description

IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0.2, 3.0.3, 3.0.4, and 3.1.0, IBM Transformation Extender Advanced 9.0) is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 135859.

Affected (12)

Products: Ibm: Financial Transaction Manager, Transformation Extender Advanced, Control Center

Ibm

3 products

Financial Transaction Manager

Transformation Extender Advanced

Control Center

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Ibm Financial Transaction Manager	Version 3.0.2.0
Ibm Financial Transaction Manager	Version 3.0.2.0
Ibm Financial Transaction Manager	Version 3.0.2.1
Ibm Financial Transaction Manager	Version 3.0.3.0
Ibm Financial Transaction Manager	Version 3.0.4.0
Ibm Financial Transaction Manager	Version 3.1.0.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Ibm Transformation Extender Advanced	Version 9.0

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
Ibm Control Center	Version 6.0.0.0
Ibm Control Center	Version 6.0.0.1
Ibm Control Center	Version 6.1.0.0
Ibm Control Center	Version 6.1.0.1
Ibm Control Center	Version 6.1.1.0