CVE-2023-50304 is a High severity (CVSS 7.1) XML external entity injection flaw in IBM Engineering Requirements Management DOORS Web Access 9.7.2.8. A remote attacker could expose sensitive information or consume memory. IBM's fix is fix pack 9.7.2.9, which also covers older 9.6.1.x installs.
What's affected
Product: IBM Engineering Requirements Management DOORS and DOORS Web Access, version 9.7.2.8. IBM's bulletin also lists IBM Rational DOORS and DOORS Web Access 9.6.1.x as affected by the bulletin as a whole. Fixed: fix pack 9.7.2.9. For 9.7.x, install that fix pack. For 9.6.1.x, IBM's workaround line says to upgrade to fix pack version 9.7.2.9. NVD published the record on 18 July 2024.
Severity: the NVD record gives 7.1 High with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, and IBM's bulletin gives the same base score of 7.1, so the sources agree.
The same bulletin addresses nine other CVEs in Apache Portable Runtime and the Expat XML parser, which shows how a single product release can carry several library level findings. Read it in full when you plan the upgrade.
How to check if you're exposed
Find the DOORS and DOORS Web Access versions installed. The product's About dialog and the web access server's version page both show it.
If the version is 9.7.2.8, you are in the range named by IBM. If it is 9.6.1.x, IBM's bulletin says to upgrade to 9.7.2.9. Check every server, including the web access host in a DMZ or test environment, and note who can reach it.
IBM's bulletin has the full list of affected products and the download link for the fix pack on Fix Central. Use it to confirm that your exact product name matches.
Vendor products like this do not appear in a dependency scan, so the inventory is the control. Record each instance with its version, owner and the networks that can reach it.
What to do now
- Download fix pack 9.7.2.9 from IBM Fix Central, following the bulletin, and install it on the DOORS Web Access server and the DOORS server.
- If you still run 9.6.1.x, plan the upgrade to 9.7.2.9, as IBM instructs.
- Limit access to the web access server to the networks and users that need it.
- Review the other CVEs in the bulletin so one change window covers them all.
- Record the new version in your inventory.
Why it matters
The weakness is CWE-611, improper restriction of XML external entity reference. When an XML parser is allowed to resolve external entities, a document can tell the parser to fetch or read things outside the document itself, such as local files or network resources. IBM describes the outcome as exposure of sensitive information or memory consumption.
The vector shows low privileges and no user interaction, so someone with an ordinary account on the web access server is the likely source. XXE is a well understood class, and the usual fix is turning off external entity processing in the parser, which is cheap once identified.
KEV is false, and neither the record nor the bulletin claims exploitation. Requirements and traceability data can be sensitive, since it often describes safety or design decisions. The Gold directory lists this CVE and its weakness class, and the free scan at gold.safeguard.sh/scan covers open source libraries in your own repositories.
Quick check
Which version fixes it?
Fix pack 9.7.2.9, according to IBM. For 9.6.1.x installs, IBM says to upgrade to 9.7.2.9.
Is a login needed?
The record vector shows low privileges required, so an authenticated user is the expected source.
Sources
Last reviewed: 19 October 2026.
