Vulnerability Details : CVE-2014-8924
The server in IBM License Metric Tool 7.2.2 before IF15 and 7.5 before IF24 and Tivoli Asset Discovery for Distributed 7.2.2 before IF15 and 7.5 before IF24 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Vulnerability category: XML external entity (XXE) injection
Products affected by CVE-2014-8924
- cpe:2.3:a:ibm:license_metric_tool:7.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:license_metric_tool:7.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:tivoli_asset_discovery_for_distributed:7.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:tivoli_asset_discovery_for_distributed:7.5:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-8924
0.40%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 58 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-8924
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:P/A:N |
10.0
|
4.9
|
NIST |
References for CVE-2014-8924
-
http://www.securitytracker.com/id/1032275
IBM License Metric Tool XML External Entity Processing Flaw Lets Remote Users Obtain Potentially Sensitive Information - SecurityTracker
-
http://www-01.ibm.com/support/docview.wss?uid=swg21882820
IBM notice: The page you requested cannot be displayedPatch;Vendor Advisory
Jump to