CVE-2016-2908
Estado: ModificadaCrítica (9.1)—
IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- Puntuación base: 9.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 3.39%
- Percentil entre todas las CVEs puntuadas: 88
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (3)
CWE
- CWE-611
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2016-2908",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.4,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 4.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 9.1,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.2,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "psirt@us.ibm.com",
"affectedData": [
{
"vendor": "IBM Corporation",
"product": "Access Manager",
"versions": [
{
"status": "affected",
"version": "9.0"
},
{
"status": "affected",
"version": "9.0.0.1"
},
{
"status": "affected",
"version": "9.0.1"
},
{
"status": "affected",
"version": "7.0.0"
},
{
"status": "affected",
"version": "8.0.0"
},
{
"status": "affected",
"version": "8.0.0.1"
},
{
"status": "affected",
"version": "8.0.0.2"
},
{
"status": "affected",
"version": "8.0.0.3"
},
{
"status": "affected",
"version": "8.0.0.4"
},
{
"status": "affected",
"version": "8.0.0.5"
},
{
"status": "affected",
"version": "8.0.1"
},
{
"status": "affected",
"version": "8.0.1.2"
},
{
"status": "affected",
"version": "8.0.1.3"
},
{
"status": "affected",
"version": "8.0.1.4"
},
{
"status": "affected",
"version": "9.0.0"
},
{
"status": "affected",
"version": "9.0.1.0"
}
]
}
]
}
],
"published": "2017-02-01T20:59:00.300",
"references": [
{
"url": "http://www.ibm.com/support/docview.wss?uid=swg21995531",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "psirt@us.ibm.com"
},
{
"url": "http://www.securityfocus.com/bid/95295",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "psirt@us.ibm.com"
},
{
"url": "http://www.securitytracker.com/id/1038506",
"source": "psirt@us.ibm.com"
},
{
"url": "http://www.ibm.com/support/docview.wss?uid=swg21995531",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/95295",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1038506",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-611"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service."
},
{
"lang": "es",
"value": "IBM Single Sign On para Bluemix podrían permitir a un atacante remoto obtener información sensible, provocado por un error de entidad externa XML (XXE) al procesar datos XML por el analizador XML. Un atacante remoto podría explotar esta vulnerabilidad para leer archivos arbitrarios del sistema o provocar una denegación de servicio."
}
],
"lastModified": "2026-06-17T00:44:39.677",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_9.0_firmware:9.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B5B6BD9-C0DF-4359-A6C1-F66E24912800"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_9.0_firmware:9.0.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6F18D4AF-43DE-42A0-898E-50FBA7ADDDDE"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_9.0_firmware:9.0.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "847598BF-977A-4592-A6A1-2C7F04F29FDC"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EA4B8E11-83D3-4B38-90B6-4C0F536D06B6"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AFD6FF12-A3AD-4D2B-92EB-44D20AF4DD9D"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD7C3FED-3B2F-4EC9-9A9B-05EFDB0AA56B"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "250AF7A4-8DDF-427C-8BF7-788667908D77"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "76136DDE-1530-482B-9E32-3EA2496FDFCA"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8CBEA0D7-FBD0-4C7D-AB8F-73018359996A"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7CCECD9C-D506-4AEA-AE59-49A81E2D7020"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FCB6511D-5B6C-4BBB-8DEF-C37026398D6C"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4B0D27CF-70BF-4C72-A963-310272D8EBF7"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "97E19969-DD73-42F2-9E91-504E1663B268"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F9CC2E05-5179-4241-A710-E582510EEB0D"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BD1366C8-9C78-4B40-8E40-19C4DFEC2B1D"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "73E4F0CD-26DF-4975-8F40-ECB8E03A08C2"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FFE6F2A0-BD38-4853-A8FB-299A341FA0B6"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D0122CE6-44D9-4A5F-8DD4-B1F7F229FDFB"
},
{
"criteria": "cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D1C6294A-7243-499D-8371-F000BEB7CF2F"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:security_access_manager_for_mobile_appliance:8.0:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "506C4B29-BC71-4C56-BAB1-06E63BEB1DD3"
},
{
"criteria": "cpe:2.3:h:ibm:security_access_manager_for_web_appliance:8.0:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1C5EBB4D-36F8-453C-9D2C-A63490144596"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@us.ibm.com"
}