CVE-2014-3087

no score yetEPSS 1.3%

callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2014-08-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ibm:business_process_manager
ibm:websphere_application_server

References

http://secunia.com/advisories/60752
http://secunia.com/advisories/60755
http://secunia.com/advisories/60757
http://www-01.ibm.com/support/docview.wss?uid=swg1JR50616
http://www-01.ibm.com/support/docview.wss?uid=swg21679726

Check your stack JSON