Security Bulletin: IBM WebSphere Liberty XML External Entity (XXE) Injection security vulnerability in IBM FileNet Content Manager

Summary

IBM FileNet Content Manager Content Platform Engine (CPE) containers are vulnerable to IBM WebSphere Liberty XML External Entity (XXE) Injection security vulnerabilities.

Vulnerability Details

CVEID:CVE-2021-20492
**DESCRIPTION:**IBM WebSphere Application Server Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/197793 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

Update to one of the below releases to resolve this issue:

5.5.4
5.5.6

| PJ46543
PJ46543
| 5.5.4.0-P8CPE-Container-IF005 - 7/16/2021
5.5.6.0-P8CPE-Container-IF002 - 8/13/2021

Only versions covered by continuous support for fixes are listed. Please apply the listed update to remediate.

Workarounds and Mitigations

None