Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2018-1845: InfoSphere Information Server can leak data via XML
CVE-2018-1845 · published 7 years ago
Summary
Versions 11.3, 11.5, and 11.7 of IBM InfoSphere Information Server may allow a specially crafted XML file to reveal confidential information or use up system memory. This occurs when the product processes XML data without proper checks. Apply the latest security updates from IBM and review XML handling configurations to protect your data.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ibm | infosphere_information_server |
11.3 11.5 11.7 cpe:2.3:a:ibm:infosphere_information_server:11.3:*:*:*:*:*:*:* |
| ibm | infosphere_governance_catalog |
11.3 11.5 11.7 cpe:2.3:a:ibm:infosphere_governance_catalog:11.3:*:*:*:*:*:*:* |
| ibm | infosphere_information_server_on_cloud |
11.5 11.7 cpe:2.3:a:ibm:infosphere_information_server_on_cloud:11.5:*:*:*:*:*:*:* |
| ibm | infosphere_information_server_business_glossary |
9.1 cpe:2.3:a:ibm:infosphere_information_server_business_glossary:9.1:*:*:*:*:*:*:* |
| ibm | infosphere_information_server_metadata_workbench |
9.1 cpe:2.3:a:ibm:infosphere_information_server_metadata_workbench:9.1:*:*:*:*:*:*:* |
Original advisory text
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to ...
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150905.
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/150905 VDB Entry Vendor Advisory
- https://www.ibm.com/support/docview.wss?uid=ibm10738917 Patch Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-611XML External Entity (XXE)
Timeline
Published17 Jun 2019
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-1845 · NVD
Track software like this
Free during beta