CVE-2014-4669

HP Enterprise Maps 1.00 allows remote authenticated users to read arbitrary files via a WSDL document containing an XML external entity declaration in conjunction with an entity reference within a GetQuote operation, related to an XML External Entity (XXE) issue.

CVSS v2.0 3.5 LOW

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:P/I:N/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://packetstormsecurity.com/files/127239/HP-Enterprise-Maps-1.00-Authenticated-XXE-Injection.html	Exploit
http://seclists.org/fulldisclosure/2014/Jun/127
http://www.securityfocus.com/bid/68200
http://packetstormsecurity.com/files/127239/HP-Enterprise-Maps-1.00-Authenticated-XXE-Injection.html	Exploit
http://seclists.org/fulldisclosure/2014/Jun/127
http://www.securityfocus.com/bid/68200

Configurations

Configuration 1 (hide)

cpe:2.3:a:hp:enterprise_maps:1.00:*:*:*:*:*:*:*

History

21 Nov 2024, 02:10

Type	Values Removed	Values Added
References	~~() http://packetstormsecurity.com/files/127239/HP-Enterprise-Maps-1.00-Authenticated-XXE-Injection.html - Exploit~~	() http://packetstormsecurity.com/files/127239/HP-Enterprise-Maps-1.00-Authenticated-XXE-Injection.html - Exploit
References	~~() http://seclists.org/fulldisclosure/2014/Jun/127 -~~	() http://seclists.org/fulldisclosure/2014/Jun/127 -
References	~~() http://www.securityfocus.com/bid/68200 -~~	() http://www.securityfocus.com/bid/68200 -

Information

Published : 2014-06-28 15:55

Updated : 2024-11-21 02:10

NVD link : CVE-2014-4669

Mitre link : CVE-2014-4669

CVE.ORG link : CVE-2014-4669

JSON object : View

Products Affected

hp

enterprise_maps

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2014-4669", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-06-28T15:55:08.490", "references": [{"url": "http://packetstormsecurity.com/files/127239/HP-Enterprise-Maps-1.00-Authenticated-XXE-Injection.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2014/Jun/127", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/68200", "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.com/files/127239/HP-Enterprise-Maps-1.00-Authenticated-XXE-Injection.html", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://seclists.org/fulldisclosure/2014/Jun/127", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/68200", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "HP Enterprise Maps 1.00 allows remote authenticated users to read arbitrary files via a WSDL document containing an XML external entity declaration in conjunction with an entity reference within a GetQuote operation, related to an XML External Entity (XXE) issue."}, {"lang": "es", "value": "HP Enterprise Maps 1.00 permite a usuarios remotos autenticados leer ficheros arbitrarios a trav\u00e9s de un documento WSDL que contiene una declaraci\u00f3n de entidad externa XML en conjunto con una referencia de entidad dentro de una operaci\u00f3n GetQuote, relacionado con un problema de entidad externa XML (XXE)."}], "lastModified": "2024-11-21T02:10:40.807", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hp:enterprise_maps:1.00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC94DBEF-8D4B-4C1C-AA95-93DC6DDF2BD0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}