← Back

CVE-2024-39726

nvd nist
Published: Nov 15, 2024Modified: Nov 19, 2024

JSON object

Loading...
8.2
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Exploitability: 3.9 / Impact: 4.2
Source: psirt@us.ibm.com (Secondary)

Description

IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Affected (2)

Ibm
1 product
Engineering Lifecycle Optimization Engineering Insights
Configuration A
2 vulnerable · 2 platform
Vulnerable SoftwareAffected Versions
Ibm
Engineering Lifecycle Optimization Engineering Insights
Version 7.0.2
Engineering Lifecycle Optimization Engineering Insights
Version 7.0.3
Running on/withPlatform Versions
Linux
Linux Kernel
All versions
Microsoft
Windows
All versions

Related CWEs

CWE-611
Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (1)

Source: psirt@us.ibm.com
Vendor Advisory

Timeline

No history available yet.