CVE-2014-3087

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-08-17 · updated 2026-06-17
Weakness: CWE-200

Description

callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected products

IBM Business Process Manager: 7.5.0.0, 7.5.0.1, 7.5.1.0, 7.5.1.1, 7.5.1.2, 8.0.0.0 (+6)
IBM WebSphere Application Server: 7.2

References

http://secunia.com/advisories/60752
http://secunia.com/advisories/60755
http://secunia.com/advisories/60757
http://www-01.ibm.com/support/docview.wss?uid=swg1JR50616
http://www-01.ibm.com/support/docview.wss?uid=swg21679726
http://www.securityfocus.com/bid/69264
https://exchange.xforce.ibmcloud.com/vulnerabilities/94112
http://secunia.com/advisories/60752
http://secunia.com/advisories/60755
http://secunia.com/advisories/60757
http://www-01.ibm.com/support/docview.wss?uid=swg1JR50616
http://www-01.ibm.com/support/docview.wss?uid=swg21679726

Get alerted when CVE-2014-3087 or the next vulnerability affects your stack