Lucene search

[email protected]CVE-2014-8924

HistoryMay 20, 2015 - 10:59 a.m.

CVE-2014-8924

2015-05-2010:59:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

ibm

license metric tool

tivoli

asset discovery

xml

xxe

cve-2014-8924

security vulnerability

7.4 High

AI Score

Confidence

Low

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.002 Low

EPSS

Percentile

54.7%

JSON

The server in IBM License Metric Tool 7.2.2 before IF15 and 7.5 before IF24 and Tivoli Asset Discovery for Distributed 7.2.2 before IF15 and 7.5 before IF24 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CPENameOperatorVersion
ibm:license_metric_toolibm license metric tooleq7.5
ibm:license_metric_toolibm license metric tooleq7.2.2
ibm:tivoli_asset_discovery_for_distributedibm tivoli asset discovery for distributedeq7.2.2
ibm:tivoli_asset_discovery_for_distributedibm tivoli asset discovery for distributedeq7.5

CPE	Name	Operator	Version
ibm:license_metric_tool	ibm license metric tool	eq	7.5
ibm:license_metric_tool	ibm license metric tool	eq	7.2.2
ibm:tivoli_asset_discovery_for_distributed	ibm tivoli asset discovery for distributed	eq	7.2.2
ibm:tivoli_asset_discovery_for_distributed	ibm tivoli asset discovery for distributed	eq	7.5

References

www-01.ibm.com/support/docview.wss?uid=swg21882820

www.securitytracker.com/id/1032275

7.4 High

AI Score

Confidence

Low

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.002 Low

EPSS

Percentile

54.7%

JSON

Related for CVE-2014-8924

prion1 cvelist1