VulnerabilityModified

CVE-2015-3160

XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submitting job XML to the server containing entity references which reference files from the Beaker…

MEDIUM 4.3EPSS 1.28%

Does this matter?

Lower severity and a low EPSS score (1.28%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.0: 4.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 1.28% probability · 68th percentile
CISA KEV: Not listed
Weakness: CWE-611
Affected: beaker-project/beaker
Source: secalert@redhat.com

References

http://www.openwall.com/lists/oss-security/2015/05/08/1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/74569Third Party Advisory, VDB Entry
https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html#beaker-20-1Release Notes, Vendor Advisory
https://bugzilla.redhat.com/attachment.cgi?id=1020003Issue Tracking, Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1215020Issue Tracking, Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2015/05/08/1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/74569Third Party Advisory, VDB Entry
https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html#beaker-20-1Release Notes, Vendor Advisory
https://bugzilla.redhat.com/attachment.cgi?id=1020003Issue Tracking, Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1215020Issue Tracking, Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.