VulnerabilityModified
CVE-2014-3066
IBM Tivoli Endpoint Manager 9.1 before 9.1.1088.0 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
MEDIUM 5.0EPSS 2.43%
Does this matter?
Lower severity and a low EPSS score (2.43%). Track it; it rarely justifies an emergency change on its own.
Description
IBM Tivoli Endpoint Manager 9.1 before 9.1.1088.0 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 2.43% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- ibm/tivoli endpoint manager
- Source
- psirt@us.ibm.com
References
- http://secunia.com/advisories/58672
- http://secunia.com/advisories/58906
- http://www-01.ibm.com/support/docview.wss?uid=swg21673961
- http://www-01.ibm.com/support/docview.wss?uid=swg21673967Vendor Advisory
- http://www.securitytracker.com/id/1030508
- https://exchange.xforce.ibmcloud.com/vulnerabilities/93630
- http://secunia.com/advisories/58672
- http://secunia.com/advisories/58906
- http://www-01.ibm.com/support/docview.wss?uid=swg21673961
- http://www-01.ibm.com/support/docview.wss?uid=swg21673967Vendor Advisory
- http://www.securitytracker.com/id/1030508
- https://exchange.xforce.ibmcloud.com/vulnerabilities/93630
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.