CVE-2016-2932 : IBM BigFix Remote Control before 9.1.3 allows remote attackers to conduct XML in

IBM BigFix Remote Control before 9.1.3 allows remote attackers to conduct XML injection attacks via unspecified vectors.

Published 2016-11-30 11:59:01

Updated 2016-12-30 21:13:49

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2016-2932

IBM » Bigfix Remote Control
Versions up to, including, (<=) 9.1.2
cpe:2.3:a:ibm:bigfix_remote_control:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 52 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE-91 XML Injection (aka Blind XPath Injection)

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Assigned by: nvd@nist.gov (Primary)

http://www.securityfocus.com/bid/94983

IBM BigFix Remote Control CVE-2016-2932 Security Bypass Vulnerability
Third Party Advisory;VDB Entry
http://www-01.ibm.com/support/docview.wss?uid=swg21991882

IBM notice: The page you requested cannot be displayed
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IV89787

IBM IV89787: SECURITY APAR CVE-2016-2932 XML INJECTION VULNERABILITY IN IBM BIGFIX REMOTE CONTROL
Vendor Advisory

Jump to