Information disclosure in IBM Filenet Business Process Framework
CVE-2013-5452
IBM FileNet Business Process Framework 4.1.0 allows remote authenticated users to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Vulnerability class: Information Disclosure
EPSS: 0.010 (60.4th percentile) — read the EPSS interpretation.
Affected products
- Ibm Filenet_business_process_framework — versions 4.1.0
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@us.ibm.com (vdb-entry, x_refsource_XF)
- psirt@us.ibm.com (vdb-entry, x_refsource_SECTRACK)
- psirt@us.ibm.com (vendor-advisory, x_refsource_AIXAPAR)
- psirt@us.ibm.com (x_refsource_CONFIRM)
- psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)