Vulnerability Details : CVE-2017-1149
IBM UrbanCode Deploy (UCD) 6.0, 6.1, and 6.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM X-Force ID: 122202.
Vulnerability category: XML external entity (XXE) injectionDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2017-1149
Probability of exploitation activity in the next 30 days: 0.13%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 48 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-1149
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:S/C:P/I:N/A:C |
8.0
|
7.8
|
NIST |
8.1
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
2.8
|
5.2
|
NIST |
CWE ids for CVE-2017-1149
-
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-1149
-
http://www.securityfocus.com/bid/98026
IBM UrbanCode Deploy CVE-2017-1149 XML External Entity Injection VulnerabilityThird Party Advisory;VDB Entry
-
http://www.ibm.com/support/docview.wss?uid=swg2C1000289
IBM Security Bulletin: Plugin Uploads in IBM UrbanCode Deploy Vulnerable to XML Injection (CVE-2017-1149)Vendor Advisory
Products affected by CVE-2017-1149
- cpe:2.3:a:ibm:urbancode_deploy:6.0.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.0.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.0.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.0.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.0.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.0.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.0.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.0.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.0.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.0.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.0.1.11:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.0.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.0.1.12:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.0.1.13:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:urbancode_deploy:6.2.0.201:*:*:*:*:*:*:*