VulnerabilityModified
CVE-2014-9360
XML external entity (XXE) vulnerability in Scalix Web Access 11.4.6.12377 and 12.2.0.14697 allows remote attackers to read arbitrary files and trigger requests to intranet servers via a crafted request.
MEDIUM 6.4EPSS 1.42%
Does this matter?
Lower severity and a low EPSS score (1.42%). Track it; it rarely justifies an emergency change on its own.
Description
XML external entity (XXE) vulnerability in Scalix Web Access 11.4.6.12377 and 12.2.0.14697 allows remote attackers to read arbitrary files and trigger requests to intranet servers via a crafted request.
- CVSS 2.0
- 6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
- EPSS
- 1.42% probability · 71th percentile
- CISA KEV
- Not listed
- Affected
- scalix/web access
- Source
- cve@mitre.org
References
- http://seclists.org/fulldisclosure/2014/Oct/133
- http://www.securityfocus.com/archive/1/533861/100/0/threaded
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141031-0_Scalix_Web_Access_XXE_v10.txt
- http://seclists.org/fulldisclosure/2014/Oct/133
- http://www.securityfocus.com/archive/1/533861/100/0/threaded
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141031-0_Scalix_Web_Access_XXE_v10.txt
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.