CVE-2025-13096
Unknown
Unknown - Not Provided
XML External Entity Injection in IBM Business Automation Workflow
Publication date: 2026-02-02
Last updated on: 2026-02-12
Assigner: IBM Corporation
Description
Description
IBM Business Automation Workflow containers V25.0.0 through V25.0.0-IF007, V24.0.1 - V24.0.1-IF007, V24.0.0 - V24.0.0-IF007 and IBM Business Automation Workflow traditional V25.0.0, V24.0.1, V24.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | business_automation_workflow | 24.0.1 |
| ibm | business_automation_workflow | 24.0.1 |
| ibm | business_automation_workflow | 24.0.1 |
| ibm | business_automation_workflow | 24.0.1 |
| ibm | business_automation_workflow | 24.0.1 |
| ibm | business_automation_workflow | 25.0.0 |
| ibm | business_automation_workflow | 24.0.0 |
| ibm | business_automation_workflow | 24.0.0 |
| ibm | business_automation_workflow | 24.0.0 |
| ibm | business_automation_workflow | 24.0.0 |
| ibm | business_automation_workflow | 24.0.0 |
| ibm | business_automation_workflow | 24.0.0 |
| ibm | business_automation_workflow | 24.0.0 |
| ibm | business_automation_workflow | to 24.0.0 (inc) |
| ibm | business_automation_workflow | to 24.0.0 (inc) |
| ibm | business_automation_workflow | 25.0.0 |
| ibm | business_automation_workflow | 25.0.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an XML external entity injection (XXE) issue in IBM Business Automation Workflow versions specified. It occurs when the software processes XML data, allowing a remote attacker to exploit the XML parser to access sensitive information or consume system memory resources.
How can this vulnerability impact me? :
The vulnerability can lead to exposure of sensitive information and excessive consumption of memory resources, potentially causing denial of service or data leakage.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70