IBM Security Bulletin: Information disclosure in WebSphere Application Server Liberty (CVE-2013-6440)
There is an information disclosure due to an XML external entity (XXE) vulnerability when using the OpenSAML features in WebSphere Application Server Liberty.
CVE(s): CVE-2013-6440
Affected product(s) and affected version(s):
This vulnerability affects the following versions and releases of IBM WebSphere Application Server:
- Liberty using samlWeb-2.0 feature
- Liberty using wsSecuritySaml-1.1 feature
Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/2zI8Yvd
X-Force Database: http://ift.tt/2hvl28Y
The post IBM Security Bulletin: Information disclosure in WebSphere Application Server Liberty (CVE-2013-6440) appeared first on IBM PSIRT Blog.
from IBM Product Security Incident Response Team http://ift.tt/2zGScwy