CVE Vulnerabilities

CVE-2014-6166

Published: Dec 18, 2014 | Modified: Sep 08, 2017
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu

The Communications Enabled Applications (CEA) service in IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4, and Feature Pack for CEA 1.x before 1.0.0.15, allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected Software

Name Vendor Start Version End Version
Websphere_application_server Ibm 8.5.0.2 8.5.0.2
Websphere_application_server Ibm 8.0.0.5 8.0.0.5
Websphere_application_server Ibm 8.5.5.1 8.5.5.1
Websphere_application_server Ibm 8.0.0.7 8.0.0.7
Websphere_application_server Ibm 8.5.5.0 8.5.5.0
Websphere_application_server Ibm 8.0.0.1 8.0.0.1
Websphere_application_server Ibm 8.0.0.4 8.0.0.4
Websphere_application_server Ibm 8.0.0.8 8.0.0.8
Websphere_application_server Ibm 8.0.0.2 8.0.0.2
Websphere_application_server Ibm 8.5.0.1 8.5.0.1
Websphere_application_server Ibm 8.5.0.0 8.5.0.0
Websphere_application_server Ibm 8.0.0.0 8.0.0.0
Websphere_application_server Ibm 8.0.0.9 8.0.0.9
Websphere_application_server Ibm 8.5.5.3 8.5.5.3
Websphere_application_server Ibm 8.0.0.3 8.0.0.3
Websphere_application_server Ibm 8.5.5.2 8.5.5.2
Websphere_application_server Ibm 8.0.0.6 8.0.0.6

References