Lucene search

RedhatCVE-2013-0315

HistoryApr 12, 2013 - 10:55 p.m.

CVE-2013-0315

2013-04-1222:55:01

CWE-264

redhat

web.nvd.nist.gov

cve-2013-0315

gatein portal

jboss enterprise portal platform

remote attack

arbitrary file read

xml entity expansion

xee

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.003

Percentile

71.2%

JSON

The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 allows remote attackers to read arbitrary files via a crafted external XML entity in an XML document, aka an XML Entity Expansion (XEE) attack.

Affected configurations

Nvd

Node

redhatjboss_enterprise_portal_platformMatch5.2.2

VendorProductVersionCPE
redhatjboss_enterprise_portal_platform5.2.2cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.2.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	jboss_enterprise_portal_platform	5.2.2	cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.2.2:::::::*

References

rhn.redhat.com/errata/RHSA-2013-0613.html

secunia.com/advisories/52552

www.osvdb.org/91121

bugzilla.redhat.com/show_bug.cgi?id=913340

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.003

Percentile

71.2%

JSON

Related for CVE-2013-0315