VulnerabilityModified
CVE-2014-5392
XML External Entity (XXE) vulnerability in JobScheduler before 1.6.4246 and 7.x before 1.7.4241 allows remote attackers to cause a denial of service and read arbitrary files or directories via a request containing an XML external entity declaration in…
MEDIUM 5.8EPSS 2.49%
Does this matter?
Lower severity and a low EPSS score (2.49%). Track it; it rarely justifies an emergency change on its own.
Description
XML External Entity (XXE) vulnerability in JobScheduler before 1.6.4246 and 7.x before 1.7.4241 allows remote attackers to cause a denial of service and read arbitrary files or directories via a request containing an XML external entity declaration in conjunction with an entity reference.
- CVSS 2.0
- 5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:P
- EPSS
- 2.49% probability · 84th percentile
- CISA KEV
- Not listed
- Affected
- sos/jobscheduler
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/128181/JobScheduler-XML-eXternal-Entity-Injection.htmlPatch
- http://www.christian-schneider.net/advisories/CVE-2014-5392.txtPatch
- http://www.securityfocus.com/archive/1/533374/100/0/threaded
- http://www.sos-berlin.com/modules/news/article.php?storyid=73Patch
- https://change.sos-berlin.com/browse/JS-1204
- http://packetstormsecurity.com/files/128181/JobScheduler-XML-eXternal-Entity-Injection.htmlPatch
- http://www.christian-schneider.net/advisories/CVE-2014-5392.txtPatch
- http://www.securityfocus.com/archive/1/533374/100/0/threaded
- http://www.sos-berlin.com/modules/news/article.php?storyid=73Patch
- https://change.sos-berlin.com/browse/JS-1204
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.