What is CVE-2015-5038?

CVE-2015-5038 is a high-severity vulnerability in Ibm Connections. CVSS score: 7.5/10. Published 2016-01-03.

How severe is CVE-2015-5038?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2015-5038 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Ibm Connections

CVE-2015-5038

IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 does not properly detect recursion during XML entity expansion, which allows remote attackers to cause a denial of service (CPU consumption and application crash) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

EPSS: 0.015 (70.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Ibm Connections — versions 4.0, 4.5, 5.0
N/a — versions n/a

Public proof-of-concept exploits

References

psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
psirt@us.ibm.com (vendor-advisory, x_refsource_AIXAPAR)

Frequently asked questions

What is CVE-2015-5038?: CVE-2015-5038 is a high-severity vulnerability in Ibm Connections. CVSS score: 7.5/10. Published 2016-01-03.
How severe is CVE-2015-5038?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2015-5038 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.