IBM Forms Experience Builder CVE-2016-0369 XML External Entity Injection Vulnerability

Bugtraq ID:	103123
Class:	Input Validation Error
CVE:	CVE-2016-0369
Remote:	Yes
Local:	No
Published:	Aug 16 2016 12:00AM
Updated:	Aug 16 2016 12:00AM
Credit:	IBM
Vulnerable:	IBM Forms Experience Builder 8.5.1 IBM Forms Experience Builder 8.6 IBM Forms Experience Builder 8.5
Not Vulnerable:

IBM Forms Experience Builder CVE-2016-0369 XML External Entity Injection Vulnerability

IBM Forms Experience Builder is prone to an XML External Entity injection vulnerability.

Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.

IBM Forms Experience Builder 8.5, 8.5.1 and 8.6 are vulnerable; other versions may also be affected.

IBM Forms Experience Builder CVE-2016-0369 XML External Entity Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM Forms Experience Builder CVE-2016-0369 XML External Entity Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Forms Experience Builder CVE-2016-0369 XML External Entity Injection Vulnerability

References:

• IBM Homepage (IBM)
  
• Security Bulletin: IBM Forms Experience Builder is vulnerable to XML External En (IBM)