CVE-2014-8090

2014-11-2115:59:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve

2014

8090

rexml

parser

ruby

denial of service

cpu

memory

consumption

xml

entity expansion

xee

attack

nvd

5.8 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.154 Low

EPSS

Percentile

95.8%

JSON

The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references, aka an XML Entity Expansion (XEE) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1821 and CVE-2014-8080.

CPENameOperatorVersion
ruby-lang:rubyruby-lang rubyeq1.9.3
ruby-lang:rubyruby-lang rubyeq2.0.0
ruby-lang:rubyruby-lang rubyeq2.1.4
ruby-lang:rubyruby-lang rubyeq2.1.3
ruby-lang:rubyruby-lang rubyeq2.1.1
ruby-lang:rubyruby-lang rubyeq2.1.2

CPE	Name	Operator	Version
ruby-lang:ruby	ruby-lang ruby	eq	1.9.3
ruby-lang:ruby	ruby-lang ruby	eq	2.0.0
ruby-lang:ruby	ruby-lang ruby	eq	2.1.4
ruby-lang:ruby	ruby-lang ruby	eq	2.1.3
ruby-lang:ruby	ruby-lang ruby	eq	2.1.1
ruby-lang:ruby	ruby-lang ruby	eq	2.1.2