CVE-2023-32327: IBM Security Access Manager Container XML external entity injection

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-03 · updated 2026-06-17
Weakness: CWE-611

Description

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 254783.

Affected products

IBM Security Verify Access: from 10.0.0.0 through 10.0.6.1
IBM Security Verify Access Docker: from 10.0.0.0 through 10.0.6.1

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/254783
https://www.ibm.com/support/pages/node/7106586
http://seclists.org/fulldisclosure/2024/Nov/0
https://exchange.xforce.ibmcloud.com/vulnerabilities/254783
https://www.ibm.com/support/pages/node/7106586

Get alerted when CVE-2023-32327 or the next vulnerability affects your stack