PT-2014-7079 · Ibm · Feature Pack For Cea+1

Published 2014-12-18 · Updated 2017-09-08 · CVE-2014-6166

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 8.0.0.0 through 8.0.0.9 IBM WebSphere Application Server versions 8.5.0.0 through 8.5.5.3 Feature Pack for CEA versions 1.0.0.0 through 1.0.0.14

Description The issue allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This affects the Communications Enabled Applications (CEA) service.

Recommendations For IBM WebSphere Application Server versions 8.0.0.0 through 8.0.0.9, update to version 8.0.0.10 or later. For IBM WebSphere Application Server versions 8.5.0.0 through 8.5.5.3, update to version 8.5.5.4 or later. For Feature Pack for CEA versions 1.0.0.0 through 1.0.0.14, update to version 1.0.0.15 or later.

Fix

Related Identifiers

CVE-2014-6166

Affected Products

Feature Pack For Cea

Ibm Websphere Application Server

References · 6

• http://www-01.ibm.com/support/docview.wss?uid=swg1PI25310 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21690185 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1PI28632 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-6166 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/97746 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6166 · Note