Critical severity · published Mar 31, 2017
CVE-2016-6111
IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data
9.1
CVSS
2.1%
EPSS
No
On KEV
Description
IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 2000833.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Cram Social Program Management · IBM Corporation
6.0.4; 6.0.5; 6.0; 5.2; 4.5; 6.0.3; +7 more · source: vendor
CS
Curam Social Program Management · Ibm
5.2; 5.2; 5.2; 6.0; 6.0; 6.0.0; +33 more · source: NVD
Affected product
CS
Cram Social Program Management
IBM Corporation