CVE-2014-4769
Estado: ModificadaMedia (4)—
IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.8 allows remote authenticated users to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N
- Puntuación base: 4
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.18%
- Percentil entre todas las CVEs puntuadas: 67
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- NVD-CWE-Other
Referencias
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR49897
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR50553
- http://www-01.ibm.com/support/docview.wss?uid=swg21685464
- http://www.securityfocus.com/bid/70872
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94836
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR49897
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR50553
- http://www-01.ibm.com/support/docview.wss?uid=swg21685464
- http://www.securityfocus.com/bid/70872
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94836
JSON original (NVD)
Mostrar
{
"id": "CVE-2014-4769",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"authentication": "SINGLE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "psirt@us.ibm.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2014-11-05T11:55:06.277",
"references": [
{
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR49897",
"source": "psirt@us.ibm.com"
},
{
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR50553",
"source": "psirt@us.ibm.com"
},
{
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21685464",
"tags": [
"Vendor Advisory"
],
"source": "psirt@us.ibm.com"
},
{
"url": "http://www.securityfocus.com/bid/70872",
"source": "psirt@us.ibm.com"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94836",
"source": "psirt@us.ibm.com"
},
{
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR49897",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR50553",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21685464",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/70872",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94836",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.8 allows remote authenticated users to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."
},
{
"lang": "es",
"value": "IBM WebSphere Commerce 6.x hasta 6.0.0.11 y 7.x hasta 7.0.0.8 permite a usuarios remotos autenticados leer ficheros arbitrarios o enviar solicitudes TCP a servidores de intranet a través de datos XML que contienen una declaración de entidad externa en conjunto con una referencia de entidad, relacionado con un problema de entidad externa XML (XXE)."
}
],
"lastModified": "2026-06-17T00:10:34.467",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B59C1AD7-5E0A-4DB6-B1F9-BAE6C6BC52D7"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C21677D0-CF4E-4958-83A7-EF8C3AF4B1D1"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CAF24659-1284-4762-925C-4879B56AC386"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "162FF755-CFF5-4AF2-B5D4-AEBA107DD93D"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4783F5D2-0709-4E5B-B6B7-DF7823E928CB"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8EB6E277-36B8-483E-8F9E-34D350BBB0EE"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "40A7EA48-BCC0-41BD-975D-0C01B6066BE7"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA2AE738-BC94-4731-B6C3-54F808756ABC"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FE23443C-6FB5-43AC-9822-1267AE61D14E"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5952ADD8-4D62-401A-A5D3-1A63706D2F36"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8BA04184-B648-48CB-8664-D53AE07196BE"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:6.0.0.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77F7D656-CFD1-4447-97CE-1D183CB41571"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "775206CE-A901-4653-BD17-DE1BFBA076FD"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:7.0.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "213C52C9-C5B5-4F26-BBB7-EE0824A995AD"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:7.0.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3CC937CD-1BE1-4827-9145-E2EA7F3AA792"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:7.0.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2A6189A9-E083-41D3-9D36-7B41D82EC197"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:7.0.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CE6F4DC0-41E3-4F73-9F62-3D415F8949C9"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:7.0.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1ACFED34-9B1E-4950-9D03-756942EF32F0"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:7.0.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "202F791B-697B-4D9C-BF5D-84F7C657C790"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:7.0.0.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "012405FA-CE85-47B6-B368-2EAEBD06A15E"
},
{
"criteria": "cpe:2.3:a:ibm:websphere_commerce:7.0.0.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "05260EDC-BD28-4F89-809A-7852E294A540"
}
],
"operator": "OR"
}
]
}
],
"evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/611.html\" target=\"_blank\">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>",
"sourceIdentifier": "psirt@us.ibm.com"
}