1. CVE-Search
  2. CVE-2015-4538
ID CVE-2015-4538
Summary The XML parser in EMC Atmos before 2.2.3.426 and 2.3.x before 2.3.1.0 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. <a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>
References
Vulnerable Configurations
  • cpe:2.3:a:emc:atmos:2.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:emc:atmos:2.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:emc:atmos:2.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:emc:atmos:2.3.0:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 22-12-2016 - 02:59)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
COMPLETE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:S/C:C/I:N/A:P
refmap via4
bugtraq 20150902 ESA-2015-137: EMC Atmos XML External Entity Injection Vulnerability
misc http://packetstormsecurity.com/files/133405/EMC-Atmos-2.3.0-XML-External-Entity-Injection.html
sectrack 1033456
Last major update 22-12-2016 - 02:59
Published 04-09-2015 - 01:59
Last modified 22-12-2016 - 02:59
Back to Top