Skip to main content

Websphere Message Broker CVE-2013-5372

MEDIUM
Resource Management Errors (CWE-399)
2013-10-19 psirt@us.ibm.com
Denial Of Service IBM Websphere Message Broker
4.3
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:N/I:N/A:P
Attack Vector
Network
Attack Complexity
M
Confidentiality
None
Integrity
None
Availability
P

Lifecycle Timeline

1
CVE Published
Oct 19, 2013 - 10:36 cve.org
MEDIUM 4.3

DescriptionCVE.org

The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities.

AnalysisAI

The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-399. The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities. Affected products include: Ibm Websphere Message Broker. Version information: before 6.1.0.12.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Websphere Message Broker

View all
CVE-2016-9706 CRITICAL
9.1 Feb 15

IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by
CVE-2012-3317 MEDIUM
6.9 Dec 05

IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of

CVE-2016-9010 MEDIUM
6.1 Feb 15

IBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the clicking action of the victim. Rat
CVE-2017-1207 MEDIUM
5.5 Jul 05

IBM WebSphere Message Broker stores user credentials in plain in clear text which can be read by a local user. Rated med
CVE-2015-7399 MEDIUM
5.3 Jan 11

IBM WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.6 and IBM Integration Bus 9 before 9.0.0.3 and 10 befor
CVE-2016-6080 MEDIUM
5.3 Feb 01

The WebAdmin context for WebSphere Message Broker allows directory listings which could disclose sensitive information t
CVE-2017-1126 MEDIUM
5.3 Oct 04

IBM WebSphere Message Broker (IBM Integration Bus 9.0 and 10.0) could allow an unauthorized user to obtain sensitive inf
CVE-2016-2961 MEDIUM
5.3 Jul 02

The integration server in IBM Integration Bus 9 before 9.0.0.6 and 10 before 10.0.0.5 and WebSphere Message Broker 8 bef
CVE-2014-6170 MEDIUM
5.0 Feb 02

The HTTPInput node in IBM WebSphere Message Broker 7.0 before 7.0.0.8 and 8.0 before 8.0.0.6 and IBM Integration Bus 9.0
CVE-2012-5952 MEDIUM
5.0 Feb 20

IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2 does not validate Basic Aut
CVE-2013-0482 MEDIUM
4.3 May 29

IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 through 8.5.0.2 and WebSphere Me
CVE-2012-5953 MEDIUM
4.3 Feb 20

IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2, when the Parse Query Strin

Same weakness CWE-399 – Resource Management Errors

View all
CVE-2013-3893 HIGH POC
8.8
CVE-2013-0025 CRITICAL POC
9.3
CVE-2015-0064 CRITICAL POC
9.3
CVE-2015-0065 CRITICAL POC
9.3
CVE-2013-3846 CRITICAL POC
9.3
CVE-2016-5427 HIGH
7.5
CVE-2013-0233 MEDIUM POC
6.8
CVE-2013-1305 HIGH
7.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2013-5372 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy