← Vulnerability feed

Vulnerability record · CVE-2017-1477 · published 13 November 2017

CVE-2017-1477: Ibm security access manager 9.0 firmware xml external entity (xxe) vulnerability

Ibm · Security Access Manager 9.0 Firmware

IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 128612.

8.1 CVSS 3.0 High EPSS 1.4% · top 28.5% CWE-611 · XML external entity (XXE)
8.1CVSS 3.0 base score, v2 5.5
1.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 128612.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.ibm.com/support/docview.wss?uid=swg22009240 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/128612 Third Party AdvisoryVDB Entry
http://www.ibm.com/support/docview.wss?uid=swg22009240 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/128612 Third Party AdvisoryVDB Entry

Track CVE-2017-1477 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2016-2908Ibm security access manager 9.0 firmware xml external entity (xxe) vulnerabilityIBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when proces…EPSS 3.4%8.8CVE-2017-1453Ibm security access manager 9.0 firmware os command injection vulnerabilityIBM Security Access Manager Appliance 9.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a spe…EPSS 2.9%8.8CVE-2016-3029Ibm security access manager 9.0 firmware cross-site request forgery vulnerabilityIBM Security Access Manager for Web is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized a…EPSS 0.45%8.0CVE-2015-5018Ibm security access manager 9.0 firmware os command injection vulnerabilityIBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows remote a…EPSS 2.7%7.5CVE-2016-5919Ibm security access manager for web 7.0 firmware inadequate encryption strength vulnerabilityIBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decryp…EPSS 0.69%7.5CVE-2016-3017Ibm security access manager 9.0 firmware vulnerabilityIBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information due to security misconfigurations.EPSS 2.2%7.5CVE-2015-5012Ibm security access manager 9.0 firmware vulnerabilityThe SSH implementation on IBM Security Access Manager for Web appliances 7.0 before 7.0.0 FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 do…EPSS 1.6%7.5CVE-2015-5010Ibm security access manager 9.0 firmware vulnerabilityIBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for i…EPSS 1.6%

Source: NIST National Vulnerability Database (record CVE-2017-1477), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.