Security Bulletin: IBM Workload Scheduler is vulnerable to XML External Entity Injection (XXE) attack

Summary

IBM Workload Scheduler is vulnerable to XML External Entity Injection (XXE) exploitation while handling uploaded XML configuration files.

Vulnerability Details

CVEID:CVE-2022-38389
**DESCRIPTION:**IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 233975.
CVSS Base score: 7.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/233975 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

APAR IJ44020 has been opened to address CVE-2022-38389.

It is available on FixCentral for 9.4 release (940-TIV-TWS-FP7-IJ44020) to be applied on top of 9.4.0.7.

APAR IJ44020 has also been included in IBM Workload Scheduler 9.5.0.6 Security Update and in IBM Workload Scheduler 10.1.0.1, both available from FixCentral.

Workarounds and Mitigations

None