Skip to content
OpenAdvisories
Unscored CVE-2014-3087 EUVD-2014-3108GHSA-cpvq-xh34-28q8

callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote aut…

Published Aug 17, 2014 · Updated Aug 6, 2024 · Assigned by ibm

Description

callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

References