NetSight
IP …
high7.1Public exploit code

CVE-2018-1821

IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150170.

Affected products

VendorProductAffected versions
IbmOperational Decision Manager
from 8.6.0.0 before 8.6.0.3
from 8.7.0.0 before 8.7.1.2
from 8.8.0.0 before 8.8.1.3
from 8.9.0.0 before 8.9.2.1

Weakness classification

CWE-611

References