IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service.
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Security_access_manager_9.0_firmware | Ibm | 9.0.0 (including) | 9.0.0 (including) |
| Security_access_manager_9.0_firmware | Ibm | 9.0.0.1 (including) | 9.0.0.1 (including) |
| Security_access_manager_9.0_firmware | Ibm | 9.0.1.0 (including) | 9.0.1.0 (including) |
| Security_access_manager_for_mobile_8.0_firmware | Ibm | 8.0.0.1 (including) | 8.0.0.1 (including) |
| Security_access_manager_for_mobile_8.0_firmware | Ibm | 8.0.0.2 (including) | 8.0.0.2 (including) |
| Security_access_manager_for_mobile_8.0_firmware | Ibm | 8.0.0.3 (including) | 8.0.0.3 (including) |
| Security_access_manager_for_mobile_8.0_firmware | Ibm | 8.0.0.5 (including) | 8.0.0.5 (including) |
| Security_access_manager_for_mobile_8.0_firmware | Ibm | 8.0.1.0 (including) | 8.0.1.0 (including) |
| Security_access_manager_for_mobile_8.0_firmware | Ibm | 8.0.1.2 (including) | 8.0.1.2 (including) |
| Security_access_manager_for_mobile_8.0_firmware | Ibm | 8.0.1.3 (including) | 8.0.1.3 (including) |
| Security_access_manager_for_mobile_8.0_firmware | Ibm | 8.0.1.4 (including) | 8.0.1.4 (including) |
| Security_access_manager_for_web_8.0_firmware | Ibm | 8.0.0.1 (including) | 8.0.0.1 (including) |
| Security_access_manager_for_web_8.0_firmware | Ibm | 8.0.0.2 (including) | 8.0.0.2 (including) |
| Security_access_manager_for_web_8.0_firmware | Ibm | 8.0.0.3 (including) | 8.0.0.3 (including) |
| Security_access_manager_for_web_8.0_firmware | Ibm | 8.0.0.5 (including) | 8.0.0.5 (including) |
| Security_access_manager_for_web_8.0_firmware | Ibm | 8.0.1.0 (including) | 8.0.1.0 (including) |
| Security_access_manager_for_web_8.0_firmware | Ibm | 8.0.1.2 (including) | 8.0.1.2 (including) |
| Security_access_manager_for_web_8.0_firmware | Ibm | 8.0.1.3 (including) | 8.0.1.3 (including) |
| Security_access_manager_for_web_8.0_firmware | Ibm | 8.0.1.4 (including) | 8.0.1.4 (including) |