CVE-2015-3160

Опубликовано: 06 сент. 2017

Источник: nvd

CVSS3: 4.3

CVSS2: 4

EPSS Низкий

Описание

XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submitting job XML to the server containing entity references which reference files from the Beaker server's file system.

Ссылки

http://www.openwall.com/lists/oss-security/2015/05/08/1
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/74569
Third Party Advisory
VDB Entry
https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html#beaker-20-1
Release Notes
Vendor Advisory
https://bugzilla.redhat.com/attachment.cgi?id=1020003
Issue Tracking
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1215020
Issue Tracking
Third Party Advisory
VDB Entry
http://www.openwall.com/lists/oss-security/2015/05/08/1
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/74569
Third Party Advisory
VDB Entry
https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html#beaker-20-1
Release Notes
Vendor Advisory
https://bugzilla.redhat.com/attachment.cgi?id=1020003
Issue Tracking
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1215020
Issue Tracking
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:beaker-project:beaker:*:*:*:*:*:*:*:*

Версия до 20.0 (включая)

EPSS

Процентиль: 49%

0.00257

Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-611

Связанные уязвимости

GHSA-3qjf-f83f-x2pm