CVE-2024-22354

IBM WebSphere Application Server XML external entity injection

State: Published
Severity: 7.0 High
Published: Apr 17, 2024
Updated: Aug 1, 2024
Reserved: Jan 8, 2024

Description

IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, or to conduct a server-side request forgery attack. IBM X-Force ID: 280401.

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L	ibm

Weaknesses

CWE-611 Improper Restriction of XML External Entity Reference

Affected Products

Product	Versions
WebSphere Application ServerIBM	8.5, 9.0Affected
WebSphere Application Server LibertyIBM	17.0.0.3 through 24.0.0.5Affected cpe:2.3:a:ibm:websphere_application_server:17.0.0.3::::liberty:::Affected cpe:2.3:a:ibm:websphere_application_server:24.0.0.5::::liberty:::Affected

References

https://www.ibm.com/support/pages/node/7148426vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/280401vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.