PT-2014-6448 · Sos Berlin · Jobscheduler

Oliver Haufe · Published 2014-09-23 · Updated 2018-10-09 · CVE-2014-5392

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions JobScheduler versions prior to 1.6.4246 JobScheduler versions 7.x prior to 1.7.4241

Description The issue allows remote attackers to cause a denial of service and read arbitrary files or directories via a request containing an XML external entity declaration in conjunction with an entity reference.

Recommendations For JobScheduler versions prior to 1.6.4246, update to version 1.6.4246 or later. For JobScheduler versions 7.x prior to 1.7.4241, update to version 1.7.4241 or later.

Fix

Related Identifiers

CVE-2014-5392

Affected Products

Jobscheduler

References · 6

• http://packetstormsecurity.com/files/128181/JobScheduler-XML-eXternal-Entity-Injection.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-5392 · Security Note
• http://christian-schneider.net/advisories/CVE-2014-5392.txt · Patch
• http://sos-berlin.com/modules/news/article.php?storyid=73 · Patch
• https://change.sos-berlin.com/browse/JS-1204 · Note
• http://securityfocus.com/archive/1/533374/100/0/threaded · Note