CVE-2017-1289 XML external entity in Runtimes for Java Technology
Remote attackers can exploit XML External Entity injection in IBM Java SDK to expose sensitive information or cause memory exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-1289?
CVE-2017-1289 is a high-severity vulnerability in IBM Corporation Runtimes for Java Technology, published on 22 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125150.
Weakness: CWE-611
Which versions are affected by CVE-2017-1289?
It affects 1 product.
Products include Ibm Sdk.
How do I fix CVE-2017-1289?
Apply the vendor's patch.
Is CVE-2017-1289 being exploited?
There is no known exploitation of CVE-2017-1289 in the wild and no public exploit code.
Other vulnerabilities in IBM Corporation Runtimes for Java Technology
Sources
Also known as GHSA-xf3v-qxxv-424v.