Lucene search

RedhatCVE-2014-0170

HistorySep 30, 2014 - 2:55 p.m.

CVE-2014-0170

2014-09-3014:55:08

redhat

web.nvd.nist.gov

cve-2014-0170

teiid

red hat jboss

data virtualization

xxe

xml external entity

security vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

6.9

Confidence

Low

EPSS

0.004

Percentile

72.4%

JSON

Teiid before 8.4.3 and before 8.7 and Red Hat JBoss Data Virtualization 6.0.0 before patch 3 allows remote attackers to read arbitrary files via a crafted request to a REST endpoint, related to an XML External Entity (XXE) issue.

Affected configurations

Nvd

Node

redhatjboss_data_virtualizationRange≤6.0.0

Node

jbossteiidRange≤8.6

jbossteiidMatch8.4

VendorProductVersionCPE
redhatjboss_data_virtualization*cpe:2.3:a:redhat:jboss_data_virtualization:*:*:*:*:*:*:*:*
jbossteiid*cpe:2.3:a:jboss:teiid:*:*:*:*:*:*:*:*
jbossteiid8.4cpe:2.3:a:jboss:teiid:8.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	jboss_data_virtualization	*	cpe:2.3:a:redhat:jboss_data_virtualization::::::::
jboss	teiid	*	cpe:2.3:a:jboss:teiid::::::::
jboss	teiid	8.4	cpe:2.3:a:jboss:teiid:8.4:::::::*

References

rhn.redhat.com/errata/RHSA-2014-1284.html

secunia.com/advisories/61530

www.securitytracker.com/id/1030886

exchange.xforce.ibmcloud.com/vulnerabilities/96192

issues.jboss.org/browse/TEIID-2911

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

6.9

Confidence

Low

EPSS

0.004

Percentile

72.4%

JSON

Related for CVE-2014-0170