Unscored severity · published Oct 19, 2013
CVE-2013-5372
The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers…
–
CVSS
2.8%
EPSS
No
On KEV
Description
The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WM
Websphere Message Broker · Ibm
6.1; 6.1.0.1; 6.1.0.2; 6.1.0.3; 6.1.0.4; 6.1.0.5; +17 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-5372
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-5372
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1507.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1508.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1509.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1793.html
secunia.com
http://secunia.com/advisories/56338
More from Websphere Message Broker
9.1
CVE-2016-9706
IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when…
6.1
CVE-2016-9010
IBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the clicking action of the victim
5.5
CVE-2017-1418
IBM Integration Bus 9.0.0.0, 9.0.0.11, 10.0.0.0, and 10.0.0.14 (including IBM WebSphere Message Broker 8.0.0.0 and 8.0.0.9) has insecure permissions on certain files
5.5
CVE-2017-1207
IBM WebSphere Message Broker stores user credentials in plain in clear text which can be read by a local user
5.3
CVE-2018-1801
IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0.0.0 through V9.0.0.10, and WebSphere Message Broker…