IBM Business Automation Workflow XXE Vulnerability Allowing Information Disclosure and Resource Consumption

A vulnerability allowing XML external entity injection (XXE) has been identified in IBM Business Automation Workflow. This issue affects both containerized and traditional versions of the software, specifically in versions 25.0.0 prior to 25.0.0-IF007, 24.0.1 prior to 24.0.1-IF007, and 24.0.0 prior to 24.0.0-IF007. The vulnerability arises when the application processes XML data, potentially allowing remote attackers to access sensitive information or exhaust memory resources.

Impact

Exploitation of this vulnerability could lead to unauthorized exposure of sensitive information or excessive consumption of memory resources, causing potential performance degradation.

Remediation

Users are advised to upgrade to version 25.0.0-IF003, 24.0.1-IF006, or 24.0.0-IF008 for the containerized version. For the traditional version, upgrade to 25.0.0-IF003, 24.0.1-IF006, or 24.0.0-IF008.