Lucene search

IBM6EBD5CB0D946B6085B083286FAB96CF3FF9D8A86F5A5D00A78EAC6CFC3D8B514

HistoryMay 03, 2023 - 6:35 p.m.

Security Bulletin: IBM ECM Content Management Interoperability Services (CMIS) woodstox/XStream security vulnerability CVE-2022-40152

2023-05-0318:35:32

www.ibm.com

ibm ecm

cmis

woodstox

xstream

cve-2022-40152

stack-based buffer overflow

denial of service

remote attacker

patch

upgrade

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.008

Percentile

81.3%

JSON

Summary

IBM ECM Content Management Interoperability Services (CMIS) woodstox/XStream security vulnerability CVE-2022-40152, affected, not vulnerable

Vulnerability Details

CVEID:CVE-2022-40152
**DESCRIPTION:**XStream is vulnerable to a denial of service, caused by a stack-based buffer overflow. By sending a specially-crafted XML data, a remote authenticated attacker could exploit this vulnerability to causes the parser to crash, and results in a denial of service condition.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/236355 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

IBM ECM Content Management Interoperability Services (CMIS)

Affected Product(s)	Version(s)
CMIS	3.0.7

Remediation/Fixes

To resolve these vulnerabilities, install one of the patch sets listed below to upgrade woodstox-core to v6.4.0 released October 25, 2022 and xStream v1.4.20 released December 24, 2022.

Product	VRMF	Remediation/First Fix
CMIS	3.0.7	CMIS v3.0.7-IF2 - 4/28/2023

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmfilenet_content_managerMatch3.0.7

VendorProductVersionCPE
ibmfilenet_content_manager3.0.7cpe:2.3:a:ibm:filenet_content_manager:3.0.7:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	filenet_content_manager	3.0.7	cpe:2.3:a:ibm:filenet_content_manager:3.0.7:::::::*

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.008

Percentile

81.3%

JSON

Related for 6EBD5CB0D946B6085B083286FAB96CF3FF9D8A86F5A5D00A78EAC6CFC3D8B514