IBM Engineering Lifecycle Management XML External Entity Injection Vulnerability

A vulnerability allowing XML external entity injection (XXE) has been identified in IBM Engineering Lifecycle Management versions 7.0.3 (iFix001 through iFix021), 7.1.0 (iFix001 through iFix009), and 7.2.0 and 7.2.0 iFix001. This vulnerability allows authenticated attackers to exploit XXE when the application processes XML data, potentially leading to the exposure of sensitive information or excessive memory consumption.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive information or excessive memory usage, potentially leading to a denial-of-service condition.

Remediation

Users are advised to upgrade to IBM Engineering Lifecycle Management version 7.0.3 (iFix022), 7.1.0 (iFix010), or 7.2.0 (iFix002).