PT-2014-8959 · Scalix · Scalix Web Access

Publicado 2014-12-10 · Atualizado 2018-10-09 · CVE-2014-9360

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Scalix Web Access versions 11.4.6.12377 through 12.2.0.14697

Description The issue allows remote attackers to read arbitrary files and trigger requests to intranet servers via a crafted request. This is due to an XML external entity (XXE) vulnerability.

Recommendations For versions 11.4.6.12377 through 12.2.0.14697, consider disabling the XML parsing functionality until a patch is available. Restrict access to sensitive files and intranet servers to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2014-9360

Produtos afetados

Scalix Web Access

Referências · 4

• https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141031-0_Scalix_Web_Access_XXE_v10.txt · Nota
• http://securityfocus.com/archive/1/533861/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-9360 · Nota de Segurança
• http://seclists.org/fulldisclosure/2014/Oct/133 · Nota