VYPR
← All advisories
High severity7.0NVD Advisory· Published Apr 17, 2024· Updated Jun 17, 2026

CVE-2024-22354

CVE-2024-22354

Description

IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, or to conduct a server-side request forgery attack. IBM X-Force ID: 280401.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • IBM/Websphere Application Server4 versions
    cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:liberty:*:*:*+ 3 more
    • cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:liberty:*:*:*range: >=17.0.0.3,<24.0.0.6
    • cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:traditional:*:*:*range: >=8.5.0.0,<8.5.5.26
    • cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*range: 8.5, 9.0
    • (no CPE)range: 8.5, 9.0
  • IBM/WebSphere Application Server Liberty Profilellm-fuzzy
    Range: 17.0.0.3 through 24.0.0.5

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.