Lucene search
IBMC868750A64F1F0DE2A582ECF9C49046F23D8C1A898586CEBEE0D5DF55CF4FBA1HistoryNov 13, 2020 - 6:51 p.m.
Security Bulletin: Dom4j XML Injection Vulnerability Affects IBM Sterling B2B Integrator (CVE-2018-1000632)
2020-11-1318:51:11
www.ibm.com
11
0.003 Low
EPSS
Percentile
71.0%
Summary
IBM Sterling B2B Integrator has addressed a Dom4j XML injection vulnerability.
Vulnerability Details
CVEID:CVE-2018-1000632
**DESCRIPTION:**dom4j could allow a remote attacker to execute arbitrary code on the system, caused by improper input validation in multiple methods. By sending a specially-crafted XML content, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/148750 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Sterling B2B Integrator | 6.0.0.0 - 6.0.3.2 |
| IBM Sterling B2B Integrator | 5.2.0.0 - 5.2.6.5_2 |
Remediation/Fixes
| Product & Version | APAR | ** Remediation & Fix** |
|---|---|---|
| 5.2.0.0 - 5.2.6.5_2 | IT34904 | Apply IBM Sterling B2B Integrator version 5.2.6.5_3, 6.0.3.3 or 6.1.0.0 on Fix Central |
| 6.0.0.0 - 6.0.3.2 | IT34904 | Apply IBM Sterling B2B Integrator version 6.0.3.3 or 6.1.0.0 on Fix Central |
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm sterling b2b integrator | eq | 5.2.0.0 | |
| ibm sterling b2b integrator | eq | 6.0.3.2 |
Related
openvas
openvas
openSUSE: Security Advisory for dom4j (openSUSE-SU-2018:2931-1)
2018-09-28 00:00:00
Fedora: Security Advisory for dom4j (FEDORA-2021-f28c870528)
2021-05-13 00:00:00
Debian: Security Advisory (DLA-1517-1)
2018-09-24 00:00:00
fedora
fedora
[SECURITY] Fedora 33 Update: dom4j-2.0.3-1.fc33
2021-05-12 16:13:28
[SECURITY] Fedora 34 Update: dom4j-2.0.3-1.fc34
2021-05-12 05:44:36
redhatcve
redhatcve
CVE-2018-1000632
2020-03-16 07:35:07
cvelist
cvelist
CVE-2018-1000632
2018-08-20 19:00:00
github
github
Dom4j contains a XML Injection vulnerability
2018-10-16 17:01:25
osv
osv
dom4j vulnerability
2020-11-05 16:09:57
CVE-2018-1000632
2018-08-20 19:31:31
dom4j - security update
2018-09-24 00:00:00
nessus
nessus
EulerOS 2.0 SP2 : dom4j (EulerOS-SA-2019-2405)
2019-12-10 00:00:00
openSUSE Security Update : dom4j (openSUSE-2018-1486)
2018-12-07 00:00:00
RHEL 7 : dom4j (Unpatched Vulnerability)
2024-06-03 00:00:00
suse
suse
Security update for dom4j (moderate)
2018-09-28 12:13:53
Security update for dom4j (moderate)
2018-12-07 12:12:51
Security update for dom4j (moderate)
2018-12-08 00:22:56
nvd
nvd
CVE-2018-1000632
2018-08-20 19:31:31
ibm
ibm
debiancve
debiancve
CVE-2018-1000632
2018-08-20 19:31:31
prion
prion
Input validation
2018-08-20 19:31:00
cve
cve
CVE-2018-1000632
2018-08-20 19:31:31
ubuntucve
ubuntucve
CVE-2018-1000632
2018-08-20 00:00:00
veracode
veracode
XML External Entity (XXE)
2018-08-21 09:14:23
debian
debian
[SECURITY] [DLA 1517-1] dom4j security update
2018-09-24 18:11:01
mageia
mageia
Updated dom4j packages fix security vulnerability
2019-02-14 11:38:16
ubuntu
ubuntu
dom4j vulnerability
2020-11-05 00:00:00
redhat
redhat
atlassian
atlassian
hp
hp
HP Device Manager Security Updates
2023-10-20 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - January 2019
2019-01-15 00:00:00
Oracle Critical Patch Update Advisory - April 2021
2021-04-20 00:00:00
Oracle Critical Patch Update Advisory - July 2020
2020-07-14 00:00:00
0.003 Low
EPSS
Percentile
71.0%
Related for C868750A64F1F0DE2A582ECF9C49046F23D8C1A898586CEBEE0D5DF55CF4FBA1