Vulnerability Details : CVE-2016-3033
IBM AppScan Source 8.7 through 9.0.3.3 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Vulnerability category: XML external entity (XXE) injectionDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2016-3033
Probability of exploitation activity in the next 30 days: 0.19%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 56 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2016-3033
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
5.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:P |
8.0
|
4.9
|
NIST |
|
8.1
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
2.8
|
5.2
|
NIST |
CWE ids for CVE-2016-3033
-
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-3033
-
http://www.securityfocus.com/bid/92388
IBM AppScan Source CVE-2016-3033 XML External Entity Denial of Service VulnerabilityThird Party Advisory;VDB Entry
-
http://www-01.ibm.com/support/docview.wss?uid=swg21987326
IBM Security Bulletin:AppScan Source vulnerable to denial of service caused by an XML External Entity (CVE-2016-3033)Vendor Advisory
Products affected by CVE-2016-3033
- cpe:2.3:a:ibm:appscan_source:9.0.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:appscan_source:9.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:appscan_source:9.0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:appscan_source:9.0.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:appscan_source:9.0.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:appscan_source:8.7:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:appscan_source:8.7.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:appscan_source:8.8:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:appscan_source:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:appscan_source:9.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:appscan_source:9.0.3:*:*:*:*:*:*:*