CVE-2014-0171 — MEDIUM (5.0)

Q: How severe is CVE-2014-0171?

CVE-2014-0171 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2014-0171?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Jboss Data Virtualization, Odata4J Project Odata4J.

Vulnerability Description

XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint.

CVSS Score

5.0

MEDIUM

AV:N/AC:L/Au:N/C:P/I:N/A:N

Confidentiality

PARTIAL

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Redhat	Jboss Data Virtualization	<= 6.0.0
Odata4J Project	Odata4J	-

References

http://rhn.redhat.com/errata/RHSA-2015-0034.htmlVendor Advisory
https://issues.jboss.org/browse/TEIID-2911Exploit
http://rhn.redhat.com/errata/RHSA-2015-0034.htmlVendor Advisory
https://issues.jboss.org/browse/TEIID-2911Exploit

FAQ

What is CVE-2014-0171?

CVE-2014-0171 is a vulnerability with a CVSS score of 5.0 (MEDIUM). XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a ...

How severe is CVE-2014-0171?

CVE-2014-0171 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2014-0171?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Jboss Data Virtualization, Odata4J Project Odata4J.