VulnerabilityModified

CVE-2014-8871

Directory traversal vulnerability in hybris Commerce software suite 5.0.3.3 and earlier, 5.0.0.3 and earlier, 5.0.4.4 and earlier, 5.1.0.1 and earlier, 5.1.1.2 and earlier, 5.2.0.3 and earlier, and 5.3.0.1 and earlier.

HIGH 7.5EPSS 4.08%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (4.08%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.0: 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 4.08% probability · 90th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: sap/hybris
Source: cve@mitre.org

References

http://packetstormsecurity.com/files/130444/Hybris-Commerce-Software-Suite-5.x-File-Disclosure-Traversal.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Feb/63Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/534722/100/1600/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/72681Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/130444/Hybris-Commerce-Software-Suite-5.x-File-Disclosure-Traversal.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Feb/63Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/534722/100/1600/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/72681Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.