cve-2014-4814
Vulnerability from cvelistv5
Published
2014-10-28 19:00
Modified
2024-08-06 11:27
Severity ?
Summary
IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 does not properly detect recursion during entity expansion, which allows remote authenticated users to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
References
psirt@us.ibm.comhttp://secunia.com/advisories/59740
psirt@us.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg1PI24622
psirt@us.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21684651Patch, Vendor Advisory
psirt@us.ibm.comhttp://www.securityfocus.com/bid/70758
psirt@us.ibm.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/95391
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/59740
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg1PI24622
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg21684651Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/70758
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/95391
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:27:36.885Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ibm-wsportal-cve20144814-xee(95391)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95391"
          },
          {
            "name": "70758",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/70758"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21684651"
          },
          {
            "name": "PI24622",
            "tags": [
              "vendor-advisory",
              "x_refsource_AIXAPAR",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI24622"
          },
          {
            "name": "59740",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/59740"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-24T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 does not properly detect recursion during entity expansion, which allows remote authenticated users to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "name": "ibm-wsportal-cve20144814-xee(95391)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95391"
        },
        {
          "name": "70758",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/70758"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21684651"
        },
        {
          "name": "PI24622",
          "tags": [
            "vendor-advisory",
            "x_refsource_AIXAPAR"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI24622"
        },
        {
          "name": "59740",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/59740"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2014-4814",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 does not properly detect recursion during entity expansion, which allows remote authenticated users to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ibm-wsportal-cve20144814-xee(95391)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95391"
            },
            {
              "name": "70758",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/70758"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21684651",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21684651"
            },
            {
              "name": "PI24622",
              "refsource": "AIXAPAR",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI24622"
            },
            {
              "name": "59740",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/59740"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2014-4814",
    "datePublished": "2014-10-28T19:00:00",
    "dateReserved": "2014-07-09T00:00:00",
    "dateUpdated": "2024-08-06T11:27:36.885Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-4814\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2014-10-28T19:55:02.917\",\"lastModified\":\"2024-11-21T02:10:55.030\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 does not properly detect recursion during entity expansion, which allows remote authenticated users to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.\"},{\"lang\":\"es\",\"value\":\"IBM WebSphere Portal 6.1.0 hasta 6.1.0.6 CF27, 6.1.5 hasta 6.1.5.3 CF27, 7.0 hasta 7.0.0.2 CF28, 8.0 hasta 8.0.0.1 CF14, y 8.5.0 anterior a CF03 no detecta debidamente la recursi\u00f3n durante la expansi\u00f3n de entidades, lo que permite a usuarios remotos autenticados causar una denegaci\u00f3n de servicio (consumo de memoria y CPU) a trav\u00e9s de un documento XML manipulado que contiene un n\u00famero grande de referencias de entidades anidadas, un problema similar a CVE-2003-1564.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:N/I:N/A:P\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-399\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:6.1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E618064A-3D05-4DC6-9A47-0EDF2427642F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:6.1.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3DE74154-3E79-4D56-96C4-D8E644F1419D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:6.1.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA915826-5D89-43E9-83E7-88973648302A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:6.1.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C5DB29F4-59AB-439C-91C4-CDF677676C26\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:6.1.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D6CA922-11EF-4315-A09A-B4A8937E4CF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:6.1.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"526738D7-1AF8-4A8F-B833-BA0E35973A3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:6.1.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"13D6BE9C-16FD-4FB4-8A87-56B42C246316\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:6.1.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F1964FC-672F-4139-938F-A8EF9D86D9C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:6.1.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C5B50CEA-AFC4-4B45-9954-519965237FC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:6.1.5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0902AC0F-EA4D-4E65-A70A-15DE9B904B35\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:6.1.5.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D808F95D-C6BD-43EB-B16C-66449977BCFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:7.0.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D303B0B9-CDAB-409B-AE44-512D4791C36F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:7.0.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C6ECEE98-B276-4ED6-AA5A-109EA57E9925\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:7.0.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E4FF84B-A17F-464B-A718-67C44D2C69BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:8.0.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C90EF7A4-8181-42C3-BB95-395D0DD94C14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:8.0.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F40E0F5-B964-4BDC-828E-7571619F7C5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_portal:8.5.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D03AF20E-0C29-45A6-9B7F-8260D8D9E8BF\"}]}]}],\"references\":[{\"url\":\"http://secunia.com/advisories/59740\",\"source\":\"psirt@us.ibm.com\"},{\"url\":\"http://www-01.ibm.com/support/docview.wss?uid=swg1PI24622\",\"source\":\"psirt@us.ibm.com\"},{\"url\":\"http://www-01.ibm.com/support/docview.wss?uid=swg21684651\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/70758\",\"source\":\"psirt@us.ibm.com\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/95391\",\"source\":\"psirt@us.ibm.com\"},{\"url\":\"http://secunia.com/advisories/59740\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www-01.ibm.com/support/docview.wss?uid=swg1PI24622\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www-01.ibm.com/support/docview.wss?uid=swg21684651\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/70758\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/95391\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.