PT-2014-8959 · Scalix · Scalix Web Access

Published 2014-12-10 · Updated 2018-10-09 · CVE-2014-9360

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Scalix Web Access versions 11.4.6.12377 through 12.2.0.14697

Description The issue allows remote attackers to read arbitrary files and trigger requests to intranet servers via a crafted request. This is due to an XML external entity (XXE) vulnerability.

Recommendations For versions 11.4.6.12377 through 12.2.0.14697, consider disabling the XML parsing functionality until a patch is available. Restrict access to sensitive files and intranet servers to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2014-9360

Affected Products

Scalix Web Access

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-9360 · Security Note
• https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141031-0_Scalix_Web_Access_XXE_v10.txt · Note
• http://securityfocus.com/archive/1/533861/100/0/threaded · Note
• http://seclists.org/fulldisclosure/2014/Oct/133 · Note