PT-2014-7888 · Ow2 · Spagobi

Publicado 2014-10-08 · Atualizado 2014-10-10 · CVE-2014-7296

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SpagoBI version 5.0.0

Description The issue concerns the accessibility engine in SpagoBI, where the default configuration does not set FEATURE SECURE PROCESSING. This allows remote authenticated users to execute arbitrary Java code via a crafted XSL document.

Recommendations For SpagoBI version 5.0.0, consider setting the FEATURE SECURE PROCESSING feature to prevent the execution of arbitrary Java code. As a temporary workaround, restrict access to the accessibility engine until a proper configuration or patch is available.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2014-7296

Produtos afetados

Spagobi

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-7296 · Nota de Segurança
• http://securityfocus.com/bid/70240 · Nota
• http://spagoworld.org/jira/browse/SPAGOBI-1885 · Aviso do Fabricante