Medium WID-SEC-2023-1630 3 CVEs

IBM Integration Bus: Mehrere Schwachstellen

Published Jul 3, 2023 · Updated Jul 3, 2023 · de-DE

Vendor: IBM Product: Integration Bus 10.1 - 10.1.0.1

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Integration Bus ausnutzen, um Informationen offenzulegen oder beliebigen Programmcode auszuführen.

Product

IBM Integration Bus ist eine "lightweight" ESB, welche die Integration von SOAP oder non-SOAP Datenquellen von verschiedenen Plattformen ermöglicht.

Vulnerabilities 3

Critical 9.8

CVE-2022-28890

Processing external DTDs

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.

Apache Software Foundation Apache Jena apache-jena apache-jena Debian Ubuntu Maven

May 5, 2022
Medium 5.4

CVE-2023-22665

Apache Jena: Exposure of arbitrary execution in script engine expressions.

There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.

Apache Software Foundation Apache Jena apache-jena apache-jena Debian Ubuntu Maven

Apr 25, 2023
High —

CVE-2021-39239

XML External Entity (XXE) vulnerability

A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.

Apache Software Foundation Apache Jena apache-jena apache-jena Debian Ubuntu Maven

Sep 16, 2021

Revision history

2023-07-03 #1
Initiale Fassung

References

IBM Security Bulletin: 7009371 vom 2023-07-03
https://www.ibm.com/support/pages/node/7009371