PT-2016-3954 · Ca · Ca Release Automation

Published 2016-06-29 · Updated 2021-04-12 · CVE-2015-8698

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions CA Release Automation (formerly LISA Release Automation) versions 5.0.2 through 5.0.2-226 CA Release Automation (formerly LISA Release Automation) versions 5.5.1 through 5.5.1-1615 CA Release Automation (formerly LISA Release Automation) versions 5.5.2 through 5.5.2-433 CA Release Automation (formerly LISA Release Automation) versions 6.1.0 through 6.1.0-1025

Description The issue allows remote attackers to read arbitrary files or cause a denial of service via a request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Recommendations For versions 5.0.2 through 5.0.2-226, update to version 5.0.2-227 or later. For versions 5.5.1 through 5.5.1-1615, update to version 5.5.1-1616 or later. For versions 5.5.2 through 5.5.2-433, update to version 5.5.2-434 or later. For versions 6.1.0 through 6.1.0-1025, update to version 6.1.0-1026 or later.

Fix

Related Identifiers

CVE-2015-8698

Affected Products

Ca Release Automation

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-8698 · Security Note
• http://ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20160627-01-security-notice-for-release-automation.aspx · Vendor Advisory
• http://securitytracker.com/id/1036193 · Note
• http://securityfocus.com/bid/91497 · Note