CVE-2014-6166 — XML External Entity (XXE) Injection in IBM Websphere Application Server

3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 45.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Websphere Application Server
Timeline
PublishedDec 18
Latest updateMay 17

Description

The Communications Enabled Applications (CEA) service in IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4, and Feature Pack for CEA 1.x before 1.0.0.15, allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS vector

AV:N/AC:M/C:P/I:N/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-3jf4-5q72-7r87: The Communications Enabled Applications (CEA) service in IBM WebSphere Application Server 8↗2022-05-17
▶
CVEList
CVE-2014-6166: The Communications Enabled Applications (CEA) service in IBM WebSphere Application Server 8↗2014-12-18
▶
CVE-2014-6166 — XML External Entity (XXE) Injection | cvebase