CVE-2017-1758 XML external entity in Control Center

What is CVE-2017-1758?

CVE-2017-1758 is a high-severity vulnerability in Ibm Financial Transaction Manager, published on 21 Feb 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0.2, 3.0.3, 3.0.4, and 3.1.0, IBM Transformation Extender Advanced 9.0) is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 135859.

Weakness: CWE-611

Which versions are affected by CVE-2017-1758?

It affects 3 products.

Products include Ibm Control Center, Ibm Financial Transaction Manager, Ibm Transformation Extender Advanced.

How do I fix CVE-2017-1758?

No fix has been published for CVE-2017-1758 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-1758 being exploited?

There is no known exploitation of CVE-2017-1758 in the wild and no public exploit code.

Other vulnerabilities in Ibm Financial Transaction Manager

• CVE-2024-35112 IBM Control Center cross-site scripting Medium 5.4
• CVE-2021-20528 Cross-site scripting in Control Center Medium 5.4
• CVE-2023-43052 IBM Control Center external service interaction Medium 5.3
• CVE-2024-35114 IBM Control Center information disclosure Medium 5.3
• CVE-2021-20529 Information disclosure in Control Center Medium 5.3

All Ibm Financial Transaction Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2qpc-h4mf-gvrr.