PT-2014-7079 · Ibm · Feature Pack For Cea+1

Publicado 2014-12-18 · Atualizado 2017-09-08 · CVE-2014-6166

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 8.0.0.0 through 8.0.0.9 IBM WebSphere Application Server versions 8.5.0.0 through 8.5.5.3 Feature Pack for CEA versions 1.0.0.0 through 1.0.0.14

Description The issue allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This affects the Communications Enabled Applications (CEA) service.

Recommendations For IBM WebSphere Application Server versions 8.0.0.0 through 8.0.0.9, update to version 8.0.0.10 or later. For IBM WebSphere Application Server versions 8.5.0.0 through 8.5.5.3, update to version 8.5.5.4 or later. For Feature Pack for CEA versions 1.0.0.0 through 1.0.0.14, update to version 1.0.0.15 or later.

Correção

Identificadores relacionados

CVE-2014-6166

Produtos afetados

Feature Pack For Cea

Ibm Websphere Application Server

Referências · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/97746 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6166 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg1PI25310 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg21690185 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg1PI28632 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-6166 · Nota de Segurança