CVE-2022-32755 IBM Security Directory Server external entity injection

What is CVE-2022-32755?

CVE-2022-32755 is a medium-severity vulnerability in IBM Security Directory Server, published on 14 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

IBM Security Directory Server 6.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228505.

Weakness: CWE-611, CWE-91

Which versions are affected by CVE-2022-32755?

It affects 3 products.

Products include Ibm Security Directory Server, Ibm Security Directory Suite, Ibm Security Verify Directory.

How do I fix CVE-2022-32755?

No fix has been published for CVE-2022-32755 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-32755 being exploited?

There is no known exploitation of CVE-2022-32755 in the wild and no public exploit code.

Other vulnerabilities in IBM Security Directory Server

• CVE-2022-33164 IBM Security Directory Server path traversal High 8.7
• CVE-2019-4520 Security feature bypass in Security Directory Server High 7.5
• CVE-2015-1977 Path traversal in n/a High 7.5
• CVE-2019-4538 Open redirect in Security Directory Server High 7.4
• CVE-2019-4539 XML external entity in Security Directory Server High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cp3v-75fh-g783.