CVE-2014-6166

Опубликовано: 18 дек. 2014

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

The Communications Enabled Applications (CEA) service in IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4, and Feature Pack for CEA 1.x before 1.0.0.15, allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Комментарий

CCWE-611: Improper Restriction of XML External Entity Reference ('XXE')

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:websphere_application_server:8.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.0.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.0.0.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.0.0.3:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.0.0.4:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.0.0.5:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.0.0.6:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.0.0.7:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.0.0.8:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.0.0.9:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.5.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.5.0.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.5.5.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.5.5.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.5.5.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_application_server:8.5.5.3:*:*:*:*:*:*:*

EPSS

Процентиль: 54%

0.0031

Низкий

4.3 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-3jf4-5q72-7r87

github

больше 3 лет назад