Ibm Financial Transaction Manager Ftm For Redhat Openshift
Monthly
Authenticated attackers holding low-privileged credentials on an IBM Financial Transaction Manager (FTM) 4.x for Red Hat OpenShift deployment can exploit an XML external entity (XXE) injection flaw to disclose sensitive files and internal resources readable by the application, rated CVSS 3.1 base 6.5 (MEDIUM) with high confidentiality impact and no integrity or availability effect. Exploitation requires network reachability to an FTM endpoint that parses attacker-supplied XML with external-entity resolution enabled, plus valid credentials (PR:L) and no user interaction; because FTM is typically deployed as an internal back-office payments/financial processing system rather than an internet-facing service, exposure is usually limited to authenticated users and adjacent network positions. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, and IBM has published an advisory for the affected versions.
Authenticated attackers holding low-privileged credentials on an IBM Financial Transaction Manager (FTM) 4.x for Red Hat OpenShift deployment can exploit an XML external entity (XXE) injection flaw to disclose sensitive files and internal resources readable by the application, rated CVSS 3.1 base 6.5 (MEDIUM) with high confidentiality impact and no integrity or availability effect. Exploitation requires network reachability to an FTM endpoint that parses attacker-supplied XML with external-entity resolution enabled, plus valid credentials (PR:L) and no user interaction; because FTM is typically deployed as an internal back-office payments/financial processing system rather than an internet-facing service, exposure is usually limited to authenticated users and adjacent network positions. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, and IBM has published an advisory for the affected versions.