IBM Security Bulletin: IBM TRIRIGA is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data (CVE-2019-4208)

IBM TRIRIGA is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

CVE(s): CVE-2019-4208

Affected product(s) and affected version(s):

Affected Tririga	Affected Versions
IBM TRIRIGA Application Platform	3.5.3
IBM TRIRIGA Application Platform	3.6.0

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://www.ibm.com/support/docview.wss?uid=ibm10880263
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/159129

The post IBM Security Bulletin: IBM TRIRIGA is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data (CVE-2019-4208) appeared first on IBM PSIRT Blog.

from IBM Product Security Incident Response Team https://ibm.co/2LlN3S1