CVE-2024-54171
Published: 06 February 2025
Summary
CVE-2024-54171 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Ibm Entirex. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely identification, reporting, and correction of flaws like CVE-2024-54171 through patching as advised by IBM.
SI-10 mandates validation of XML inputs to block external entity injection and prevent sensitive information disclosure or resource exhaustion.
CM-6 enforces secure configuration settings for XML parsers in IBM EntireX to disable external entity processing and mitigate XXE.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XXE flaw (CWE-611) directly enables remote exploitation of the application for data access (T1190) and local file/system data retrieval (T1005).
NVD Description
IBM EntireX 11.1 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Deeper analysisAI
IBM EntireX 11.1 is vulnerable to CVE-2024-54171, an XML external entity (XXE) injection flaw classified under CWE-611. This vulnerability arises during the processing of XML data, enabling potential injection of external entities that could lead to unauthorized data access or resource exhaustion.
An authenticated attacker with low privileges (PR:L) can exploit this issue remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation yields high confidentiality impact through sensitive information disclosure, alongside low availability impact via memory resource consumption, without affecting integrity or scope (S:U), as reflected in the CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
IBM has issued a security advisory at https://www.ibm.com/support/pages/node/7182693, published on 2025-02-06, which provides details on the vulnerability and recommended mitigation actions.
Details
- CWE(s)