Lucene search

[email protected]CVE-2015-8698

HistoryJun 29, 2016 - 1:59 a.m.

CVE-2015-8698

2016-06-2901:59:00

[email protected]

web.nvd.nist.gov

cve-2015-8698

ca release automation

lisa release automation

xxe

security vulnerability

denial of service

nvd

3.6 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:N/A:P

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

6.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.2%

JSON

CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616, 5.5.2 before 5.5.2-434, and 6.1.0 before 6.1.0-1026 allows remote attackers to read arbitrary files or cause a denial of service via a request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected configurations

NVD

Node

broadcomrelease_automationRange5.0.2–5.0.2-227

broadcomrelease_automationRange5.5.1–5.5.1-1616

broadcomrelease_automationRange5.5.2–5.5.2-434

broadcomrelease_automationRange6.1.0–6.1.0-1026

CPENameOperatorVersion
broadcom:release_automationbroadcom release automationlt5.0.2-227
broadcom:release_automationbroadcom release automationlt5.5.1-1616
broadcom:release_automationbroadcom release automationlt5.5.2-434
broadcom:release_automationbroadcom release automationlt6.1.0-1026

CPE	Name	Operator	Version
broadcom:release_automation	broadcom release automation	lt	5.0.2-227
broadcom:release_automation	broadcom release automation	lt	5.5.1-1616
broadcom:release_automation	broadcom release automation	lt	5.5.2-434
broadcom:release_automation	broadcom release automation	lt	6.1.0-1026

References

www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20160627-01-security-notice-for-release-automation.aspx

www.securityfocus.com/bid/91497

www.securitytracker.com/id/1036193

3.6 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:N/A:P

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

6.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.2%

JSON

Related for CVE-2015-8698

prion1 cvelist1 nvd1