PT-2014-6448 · Sos Berlin · Jobscheduler

Oliver Haufe · Publicado 2014-09-23 · Atualizado 2018-10-09 · CVE-2014-5392

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions JobScheduler versions prior to 1.6.4246 JobScheduler versions 7.x prior to 1.7.4241

Description The issue allows remote attackers to cause a denial of service and read arbitrary files or directories via a request containing an XML external entity declaration in conjunction with an entity reference.

Recommendations For JobScheduler versions prior to 1.6.4246, update to version 1.6.4246 or later. For JobScheduler versions 7.x prior to 1.7.4241, update to version 1.7.4241 or later.

Correção

Identificadores relacionados

CVE-2014-5392

Produtos afetados

Jobscheduler

Referências · 6

• http://packetstormsecurity.com/files/128181/JobScheduler-XML-eXternal-Entity-Injection.html · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2014-5392 · Nota de Segurança
• https://change.sos-berlin.com/browse/JS-1204 · Nota
• http://securityfocus.com/archive/1/533374/100/0/threaded · Nota
• http://christian-schneider.net/advisories/CVE-2014-5392.txt · Correção
• http://sos-berlin.com/modules/news/article.php?storyid=73 · Correção