5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
5.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:N/A:P
0.009 Low
EPSS
Percentile
82.1%
Granite Data Services version 3.1.1-SNAPSHOT AMF framework is vulnerable to XML external entity (XXE) attack that may be leveraged to expose sensitive data on the host…
CWE-611** - Improper Restriction of XML External Entity Reference (‘XXE’)** - CVE-2016-2340
Granite Data Services provides event driven, cross-framework application that can be found on Github (<https://github.com/graniteds/graniteds>). Granite Data Services (<http://www.graniteds.org/>) provides server and client libraries that can be used to connect desktop and mobile applications to a server using the Action Message Format (AMF3) or Java Media Framework (JMF) serialization protocols.
Granite Data Services version 3.1.1-SNAPSHOT AMF framework is vulnerable to a XML external entity (XXE) attack. A XXE attacks how an application parses XML input. If the XML parsing is handled incorrectly it could potentially expose sensitive data on the server, denial of service, or server side request forgery.
A vulnerable server would allow a remote user access to sensitive data or cause a denial of service.
The CERT/CC is currently unaware of a practical solution to this problem.
Javascript is disabled. Click here to view vendors.
Group | Score | Vector |
---|---|---|
Base | 4.3 | AV:L/AC:L/Au:S/C:P/I:P/A:P |
Temporal | 3.5 | E:POC/RL:ND/RC:UC |
Environmental | 1.4 | CDP:LM/TD:L/CR:M/IR:M/AR:M |
Thanks to Travis Emmert for reporting this vulnerability.
This document was written by Kyle O’Meara.
CVE IDs: | CVE-2016-2340 |
---|---|
Date Public: | 2016-03-24 Date First Published: |
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
5.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:N/A:P
0.009 Low
EPSS
Percentile
82.1%