PT-2016-5120 · Granite · Granite Data Services

Travis Emmert · Published 2016-03-25 · Updated 2017-04-07 · CVE-2016-2340

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Granite Data Services version 3.1.1-SNAPSHOT

Description The issue allows remote authenticated users to read arbitrary files, send TCP requests to intranet servers, or cause a denial of service. This is related to an XML External Entity (XXE) issue, which occurs when an XML external entity declaration is used in conjunction with an entity reference.

Recommendations For Granite Data Services version 3.1.1-SNAPSHOT, consider disabling XML external entity processing as a temporary workaround until a patch is available. Restrict access to sensitive files and intranet servers to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2016-2340

Affected Products

Granite Data Services

References · 4

• https://osv.dev/vulnerability/CVE-2016-2340 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2340 · Security Note
• http://kb.cert.org/vuls/id/279472 · Patch
• http://securityfocus.com/bid/85426 · Note