IBM Endpoint Manager is prone to a XML External Entity Injection

This vulnerability could allow an attacker to access files on an affected server or cause an affected server to make an arbitrary HTTP GET request.

Update to the latest version.

IBM Endpoint Manager could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection (XXE) error when processing XML data. By sending specially-crafted XML data, an attacker could exploit this vulnerability to access files and obtain sensitive information on the server.

All 9.1 releases of the Console, Root Server, Web Reports and Server API earlier than 9.1.1088.0 All 9.0 releases of the Console, Root Server, Web Reports and Server API earlier than 9.0.853.0 All 8.2 releases of Web Reports and Server API earlier than 8.2.1445.0

Check the version.