Vulnerability Details : CVE-2016-0254
IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote authenticated attacker could exploit this vulnerability to consume all available CPU resources and cause a denial of service. IBM X-Force ID: 110563.
Vulnerability category: XML external entity (XXE) injectionDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2016-0254
Probability of exploitation activity in the next 30 days: 0.19%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 55 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2016-0254
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:N/A:C |
8.0
|
6.9
|
NIST |
6.5
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2016-0254
-
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-0254
-
http://www.securityfocus.com/bid/98971
IBM Cognos Business Intelligence Server XML External Entity Denial of Service VulnerabilityThird Party Advisory;VDB Entry
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/110563
IBM Cognos Business Intelligence denial of service CVE-2016-0254 Vulnerability ReportVendor Advisory;VDB Entry
-
http://www.ibm.com/support/docview.wss?uid=swg22004036
IBM Security Bulletin: IBM Cognos Business Intelligence Server 2017Q2 Security Updater : IBM Cognos Business Intelligence Server is affected by multiple vulnerabilities.Patch;Vendor Advisory
Products affected by CVE-2016-0254
- cpe:2.3:a:ibm:cognos_business_intelligence:10.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:cognos_business_intelligence:10.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:cognos_business_intelligence:10.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:cognos_business_intelligence:10.2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:cognos_business_intelligence:10.2.2:*:*:*:*:*:*:*