## Summary
IBM Business Automation Workflow containers and traditional are vulnerable to an XML External Entity (XXE) injection issue when processing XML data. A remote attacker could exploit it to expose sensitive information or consume memory resources.
## Technical Details
- Vulnerability class: CWE-611 (Improper Restriction of XML External Entity Reference)
- Condition: XXE occurs during XML parsing/processing in IBM Business Automation Workflow containers and traditional.
- Attack prerequisites (from CVSS): remote access (AV:N) with low complexity (AC:L) and low privileges required (PR:L), with no user interaction (UI:N).
- Likely outcomes (from NVD): sensitive information exposure (C:H) and memory/resource consumption (A:L).
## Affected
- IBM Business Automation Workflow containers and traditional (as stated in the NVD description)
## Impact
- Sensitive information disclosure (C:H)
- Denial of service via memory/resource consumption (A:L)
## Mitigation
1. Apply IBM vendor patches/fixes for the XXE issue in IBM Business Automation Workflow containers and traditional (per IBM advisory guidance).
2. Ensure XML parsing is configured to disallow external entity resolution (e.g., disable DTD/external entities) wherever XML is processed.
3. Add input validation and size limits for XML payloads to reduce the impact of resource exhaustion attempts.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
CWE-611