CVE-2016-2908 XML external entity in Access Manager
Remote attackers can exploit an XML External Entity flaw in IBM Single Sign On for Bluemix to read arbitrary files or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-2908?
CVE-2016-2908 is a critical vulnerability in IBM Corporation Access Manager, published on 1 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service.
Weakness: CWE-611
Which versions are affected by CVE-2016-2908?
It affects 3 products.
Products include Ibm Security Access Manager 9.0 Firmware, Ibm Security Access Manager for Mobile 8.0 Firmware, Ibm Security Access Manager for Web 8.0 Firmware.
How do I fix CVE-2016-2908?
No fix has been published for CVE-2016-2908 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-2908 being exploited?
There is no known exploitation of CVE-2016-2908 in the wild and no public exploit code.
Other vulnerabilities in IBM Corporation Access Manager
Sources
Also known as GHSA-8xx8-9g4g-c4q2.