PT-2015-4010 · Red Hat · Jbpm+1

Mswiderski · Publicado 2015-04-21 · Atualizado 2022-05-17 · CVE-2014-8125

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drools and jBPM versions prior to 6.2.0

Description The issue is related to an XML external entity (XXE) vulnerability. This vulnerability allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

Recommendations For versions prior to 6.2.0, update to version 6.2.0 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-8125

GHSA-6QX9-RF9G-7JMR

Produtos afetados

Drools

Jbpm

Referências · 7

• https://github.com/droolsjbpm/drools/commit/c48464c3b246e6ef0d4cd0dbf67e83ccd532c6d3 · Nota
• https://github.com/droolsjbpm/jbpm/commit/713e8073ecf45623cfc5c918c5cbf700203f46e5 · Nota
• http://rhn.redhat.com/errata/RHSA-2015-0850.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-0851.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-8125 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1169553 · Nota
• https://osv.dev/vulnerability/GHSA-6qx9-rf9g-7jmr · Aviso do Fabricante