CVE-2014-8924

The server in IBM License Metric Tool 7.2.2 before IF15 and 7.5 before IF24 and Tivoli Asset Discovery for Distributed 7.2.2 before IF15 and 7.5 before IF24 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21882820	Patch Vendor Advisory
http://www.securitytracker.com/id/1032275
http://www-01.ibm.com/support/docview.wss?uid=swg21882820	Patch Vendor Advisory
http://www.securitytracker.com/id/1032275

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:license_metric_tool:7.2.2:::::::*
	cpe:2.3:a:ibm:license_metric_tool:7.5:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:ibm:tivoli_asset_discovery_for_distributed:7.2.2:::::::*
	cpe:2.3:a:ibm:tivoli_asset_discovery_for_distributed:7.5:::::::*

History

21 Nov 2024, 02:19

Type	Values Removed	Values Added
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg21882820 - Patch, Vendor Advisory~~	() http://www-01.ibm.com/support/docview.wss?uid=swg21882820 - Patch, Vendor Advisory
References	~~() http://www.securitytracker.com/id/1032275 -~~	() http://www.securitytracker.com/id/1032275 -

Information

Published : 2015-05-20 10:59

Updated : 2024-11-21 02:19

NVD link : CVE-2014-8924

Mitre link : CVE-2014-8924

CVE.ORG link : CVE-2014-8924

JSON object : View

Products Affected

ibm

license_metric_tool
tivoli_asset_discovery_for_distributed

CWE

NVD-CWE-Other

{"id": "CVE-2014-8924", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-05-20T10:59:01.353", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21882820", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securitytracker.com/id/1032275", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21882820", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1032275", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The server in IBM License Metric Tool 7.2.2 before IF15 and 7.5 before IF24 and Tivoli Asset Discovery for Distributed 7.2.2 before IF15 and 7.5 before IF24 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."}, {"lang": "es", "value": "El servidor en IBM License Metric Tool 7.2.2 anterior a IF15 y 7.5 anterior a IF24 y Tivoli Asset Discovery for Distributed 7.2.2 anterior a IF15 y 7.5 anterior a IF24 permite a atacantes remotos leer ficheros arbitrarios o enviar solicitudes TCP a servidores de intranet a trav\u00e9s de datos XML que contiene una declaraci\u00f3n de entidad externa en conjunto con una referencia de entidad, relacionado con un problema de entidad externa XML (XXE)."}], "lastModified": "2024-11-21T02:19:57.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:license_metric_tool:7.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26CC2FED-B9A4-48E5-AFB2-084212D667A5"}, {"criteria": "cpe:2.3:a:ibm:license_metric_tool:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8BE43D33-3FF7-4144-B220-5F3CCFE5E458"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:tivoli_asset_discovery_for_distributed:7.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70785B4F-6CE9-40AC-93C5-9FF3B8C72B1F"}, {"criteria": "cpe:2.3:a:ibm:tivoli_asset_discovery_for_distributed:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9545AA8-2F1E-4FB9-9D22-B3E109047F9B"}], "operator": "OR"}]}], "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/611.html\">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>", "sourceIdentifier": "psirt@us.ibm.com"}