IBM InfoSphere Information Server XML External Entity Injection Vulnerability

A vulnerability allowing XML external entity injection (XXE) has been identified in IBM InfoSphere Information Server versions 11.7.0.0 prior to 11.7.1.6. This vulnerability arises when the application processes XML data, potentially allowing remote attackers to exploit it by exposing sensitive information or consuming memory resources.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information or excessive memory consumption, potentially causing a denial of service.

Remediation

Users can upgrade to IBM InfoSphere Information Server versions 11.7.1.0, 11.7.1.5, or 11.7.1.6. Alternatively, apply the IBM InfoSphere Information Server security patch associated with APAR DT454196.