PT-2016-5120 · Granite · Granite Data Services

Travis Emmert · Publicado 2016-03-25 · Atualizado 2017-04-07 · CVE-2016-2340

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Granite Data Services version 3.1.1-SNAPSHOT

Description The issue allows remote authenticated users to read arbitrary files, send TCP requests to intranet servers, or cause a denial of service. This is related to an XML External Entity (XXE) issue, which occurs when an XML external entity declaration is used in conjunction with an entity reference.

Recommendations For Granite Data Services version 3.1.1-SNAPSHOT, consider disabling XML external entity processing as a temporary workaround until a patch is available. Restrict access to sensitive files and intranet servers to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2016-2340

Produtos afetados

Granite Data Services

Referências · 4

• https://osv.dev/vulnerability/CVE-2016-2340 · Aviso do Fabricante
• http://securityfocus.com/bid/85426 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-2340 · Nota de Segurança
• http://kb.cert.org/vuls/id/279472 · Correção