« Volver al listado

CVE-2014-5392

Estado: ModificadaMedia (5.8)—

XML External Entity (XXE) vulnerability in JobScheduler before 1.6.4246 and 7.x before 1.7.4241 allows remote attackers to cause a denial of service and read arbitrary files or directories via a request containing an XML external entity declaration in conjunction with an entity reference.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SOS — Jobscheduler

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-5392",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-09-23T15:55:08.167",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/128181/JobScheduler-XML-eXternal-Entity-Injection.html",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.christian-schneider.net/advisories/CVE-2014-5392.txt",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/533374/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.sos-berlin.com/modules/news/article.php?storyid=73",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://change.sos-berlin.com/browse/JS-1204",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/128181/JobScheduler-XML-eXternal-Entity-Injection.html",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.christian-schneider.net/advisories/CVE-2014-5392.txt",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/533374/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.sos-berlin.com/modules/news/article.php?storyid=73",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://change.sos-berlin.com/browse/JS-1204",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XML External Entity (XXE) vulnerability in JobScheduler before 1.6.4246 and 7.x before 1.7.4241 allows remote attackers to cause a denial of service and read arbitrary files or directories via a request containing an XML external entity declaration in conjunction with an entity reference."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad XML External Entity (XXE) en JobScheduler anterior a 1.6.4246 y 7.x anterior a 1.7.4241 permite a atacantes remotos causar una denegación de servicio y leer archivos arbitrarios o directorios a través de una solicitud que contiene una declaración de entidad externa XML en conjunto con una referencia de entidad."
    }
  ],
  "lastModified": "2026-06-17T00:11:28.727",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sos:jobscheduler:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04063BAB-E033-4FCB-9894-11974EC85316",
              "versionEndIncluding": "1.6.4131"
            },
            {
              "criteria": "cpe:2.3:a:sos:jobscheduler:1.6.4014:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D2B9B1EE-3C37-4B0C-9AC0-7B479558CED9"
            },
            {
              "criteria": "cpe:2.3:a:sos:jobscheduler:1.6.4043:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3467B07E-0498-4B36-BCC3-DC7EC385D06D"
            },
            {
              "criteria": "cpe:2.3:a:sos:jobscheduler:1.7.4177:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9BEA7100-9FA7-4F66-9DA9-AD52AD487217"
            },
            {
              "criteria": "cpe:2.3:a:sos:jobscheduler:1.7.4189:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "337165FD-1F47-4493-89F6-73834E436C63"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/611.html\" target=\"_blank\">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>",
  "sourceIdentifier": "cve@mitre.org"
}