Vulnerability record · CVE-2017-1289 · published 22 May 2017

CVE-2017-1289: Ibm sdk xml external entity (xxe) vulnerability

Ibm · Sdk

IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125150.

8.2 CVSS 3.0 High EPSS 3.6% · top 10.8% CWE-611 · XML external entity (XXE)

8.2CVSS 3.0 base score, v2 6.4

3.6%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

12References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Sdk Ibm

References

Link	Tags
http://www.securityfocus.com/bid/98401	Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:1220
https://access.redhat.com/errata/RHSA-2017:1221
https://access.redhat.com/errata/RHSA-2017:1222
https://access.redhat.com/errata/RHSA-2017:3453
https://www.ibm.com/support/docview.wss?uid=swg22002169	PatchVendor Advisory
http://www.securityfocus.com/bid/98401	Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:1220
https://access.redhat.com/errata/RHSA-2017:1221
https://access.redhat.com/errata/RHSA-2017:1222
https://access.redhat.com/errata/RHSA-2017:3453
https://www.ibm.com/support/docview.wss?uid=swg22002169	PatchVendor Advisory

Track CVE-2017-1289 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-40609Ibm sdk deserialization of untrusted data vulnerabilityIBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe dese…EPSS 1.8%2 Aug 2023 7.8CVE-2018-1890Ibm sdk uncontrolled search path element vulnerabilityIBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by lo…EPSS 0.46%11 Mar 2019 7.5CVE-2016-3956Ibm sdk information exposure vulnerabilityThe CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, …EPSS 6.7%2 Jul 2016 6.5CVE-2019-4732Ibm sdk untrusted search path vulnerabilityIBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authent…EPSS 0.54%3 Feb 2020 6.5CVE-2018-1656Ibm sdk path traversal vulnerabilityThe IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protec…EPSS 4.5%20 Aug 2018 9.8CVE-2025-58360GeoServer WMS GetMap XXE allows unauthenticated file read and SSRFGeoServer versions 2.26.0 through 2.26.2 and before 2.25.6 accept XML input at the /geoserver/wms GetMap endpoint without sufficiently restricting ex…KEVEPSS 61%analysed25 Nov 2025 9.8CVE-2025-2776SysAid On-Prem unauthenticated XXE in Server URL processingSysAid On-Prem versions up to 23.3.40 process the Server URL without restricting XML external entities, so an unauthenticated attacker can supply cra…KEVEPSS 65%analysed7 May 2025 7.5CVE-2025-2775SysAid On-Prem unauthenticated XXE in Checkin processingSysAid On-Prem versions up to 23.3.40 process Checkin XML without restricting external entities, so an unauthenticated attacker can supply a crafted …KEVEPSS 43%analysed7 May 2025

Source: NIST National Vulnerability Database (record CVE-2017-1289), CISA KEV, FIRST EPSS (scores of 2026-10-08). This page is refreshed as NVD updates the record.