2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2009-5135" ,
"sourceIdentifier" : "psirt@us.ibm.com" ,
"published" : "2013-05-02T11:44:41.410" ,
2024-12-08 03:06:42 +00:00
"lastModified" : "2024-11-21T01:11:14.860" ,
2023-04-24 12:24:31 +02:00
"vulnStatus" : "Modified" ,
2024-07-14 02:06:08 +00:00
"cveTags" : [ ] ,
2023-04-24 12:24:31 +02:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."
} ,
{
"lang" : "es" ,
"value" : "El analizador Java XML en Echo antes v2.1.1 v3.x antes v3.0.b6 permite a atacantes remotos leer archivos arbitrarios a trav\u00e9s de una petici\u00f3n que contenga una declaraci\u00f3n de entidad externa, en relaci\u00f3n con una referencia de entidad, en relaci\u00f3n con una entidad externa XML (XXE) tema."
}
] ,
"metrics" : {
"cvssMetricV2" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "2.0" ,
"vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N" ,
2024-12-08 03:06:42 +00:00
"baseScore" : 5.0 ,
2023-04-24 12:24:31 +02:00
"accessVector" : "NETWORK" ,
"accessComplexity" : "LOW" ,
"authentication" : "NONE" ,
"confidentialityImpact" : "PARTIAL" ,
"integrityImpact" : "NONE" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "NONE"
2023-04-24 12:24:31 +02:00
} ,
"baseSeverity" : "MEDIUM" ,
"exploitabilityScore" : 10.0 ,
"impactScore" : 2.9 ,
"acInsufInfo" : false ,
"obtainAllPrivilege" : false ,
"obtainUserPrivilege" : false ,
"obtainOtherPrivilege" : false ,
"userInteractionRequired" : false
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-20"
}
]
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:*:rc5:*:*:*:*:*:*" ,
"versionEndIncluding" : "2.1.0" ,
"matchCriteriaId" : "CF021123-961D-4F87-A4BC-B88BCC0F58B0"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:alpha1:*:*:*:*:*:*" ,
"matchCriteriaId" : "5D90D99B-4814-4B2E-8201-83A980B13265"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:alpha10:*:*:*:*:*:*" ,
"matchCriteriaId" : "9D01EF43-C1BC-4DBD-9B45-84AA8B48E0E7"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:alpha11:*:*:*:*:*:*" ,
"matchCriteriaId" : "65116C05-E10C-42B3-9ACC-8CBF5CBAB54C"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:alpha12:*:*:*:*:*:*" ,
"matchCriteriaId" : "4FD96136-03C1-4E5F-8E2C-30BEAEDB4929"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:alpha13:*:*:*:*:*:*" ,
"matchCriteriaId" : "ACF27F0C-0B95-404D-8F3B-436C96E0A0D4"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:alpha14:*:*:*:*:*:*" ,
"matchCriteriaId" : "44CBA38A-41AC-406C-B3B4-AE651B10F1E2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:alpha15:*:*:*:*:*:*" ,
"matchCriteriaId" : "501F4DC7-79CE-40F6-AC7B-D39BA6AF7E95"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:alpha16:*:*:*:*:*:*" ,
"matchCriteriaId" : "E60FA2A7-174A-4472-AA1C-C6FD846C9E66"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:alpha2:*:*:*:*:*:*" ,
"matchCriteriaId" : "A1EE0BF3-5644-4F9C-A888-06FCE2077963"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:alpha3:*:*:*:*:*:*" ,
"matchCriteriaId" : "B0B134AD-5557-4BBC-BCAE-7C9CB1E592E3"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:alpha4:*:*:*:*:*:*" ,
"matchCriteriaId" : "A17C39E4-2B90-4D93-BCA8-3F7CAF1585F6"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:alpha5:*:*:*:*:*:*" ,
"matchCriteriaId" : "C1705FB5-15E1-4694-B948-497D5C95D126"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:alpha6:*:*:*:*:*:*" ,
"matchCriteriaId" : "D4A11C24-C39C-439B-A368-87DC22C47826"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:alpha7:*:*:*:*:*:*" ,
"matchCriteriaId" : "49FAFF95-7F30-40A2-8ACF-704E3FFBF3C6"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:alpha8:*:*:*:*:*:*" ,
"matchCriteriaId" : "7F821C24-5926-4E20-9B7D-C9A2D527663B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:alpha9:*:*:*:*:*:*" ,
"matchCriteriaId" : "344A24E8-7531-41B3-988B-CC77FAFAC7D3"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:beta1:*:*:*:*:*:*" ,
"matchCriteriaId" : "C1495CAE-A0D4-4830-8223-6F4D750748A5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:beta2:*:*:*:*:*:*" ,
"matchCriteriaId" : "FBC5075A-8D97-456A-A9CB-6876844FBA18"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:beta3:*:*:*:*:*:*" ,
"matchCriteriaId" : "5C67FDB5-3DA1-4FF4-AB21-8B4973F33534"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:beta4:*:*:*:*:*:*" ,
"matchCriteriaId" : "AD88C19A-96A2-443D-A9DF-00159C14579D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:rc1:*:*:*:*:*:*" ,
"matchCriteriaId" : "BDBF9E29-334D-468D-9443-076A7827030F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:rc2:*:*:*:*:*:*" ,
"matchCriteriaId" : "7A704287-6BE5-4E26-8BF1-42C23B037BD3"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:rc3:*:*:*:*:*:*" ,
"matchCriteriaId" : "92814F77-C754-470D-AC63-7B6AF2E3879E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:rc4:*:*:*:*:*:*" ,
"matchCriteriaId" : "267261D5-2646-4559-A605-B8F9E8CA14E2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:rc5:*:*:*:*:*:*" ,
"matchCriteriaId" : "5BD62065-78EB-44C2-901A-F1811DDCF5F4"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:rc6:*:*:*:*:*:*" ,
"matchCriteriaId" : "6C2C1E23-1DC1-449A-9660-789880AAC824"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0:rc7:*:*:*:*:*:*" ,
"matchCriteriaId" : "3CD0EAF4-3F21-428B-A7DD-7B3A9B3F8D14"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0.1:test1:*:*:*:*:*:*" ,
"matchCriteriaId" : "FB73AC1A-B158-41A8-9758-6C309D565896"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0.1:test2:*:*:*:*:*:*" ,
"matchCriteriaId" : "0CDCA7D1-1704-4623-BBF0-1A0BDFA3E237"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.0.1:test3:*:*:*:*:*:*" ,
"matchCriteriaId" : "EDDF6962-8605-41DD-85FA-0B4D024493C9"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.1.0:beta1:*:*:*:*:*:*" ,
"matchCriteriaId" : "0C218F98-E07E-4AF8-B471-85E94876C36A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.1.0:beta2:*:*:*:*:*:*" ,
"matchCriteriaId" : "FA32D59C-3042-44BD-8D20-EB3B636B25DB"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.1.0:beta3:*:*:*:*:*:*" ,
"matchCriteriaId" : "A8A76353-C166-48B9-A668-F66419E7A166"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.1.0:beta4:*:*:*:*:*:*" ,
"matchCriteriaId" : "4DAB82C9-A3F5-4285-8FD1-431E16C31FEA"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.1.0:beta5:*:*:*:*:*:*" ,
"matchCriteriaId" : "3F8AF0C7-9B6A-4CD0-8FAD-FED9C3A25932"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.1.0:rc1:*:*:*:*:*:*" ,
"matchCriteriaId" : "658CFBD7-5A23-4628-9934-97B36E1D2DCC"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.1.0:rc2:*:*:*:*:*:*" ,
"matchCriteriaId" : "FDF90C29-B111-44AF-B8F2-4002EA4EC6BC"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.1.0:rc3:*:*:*:*:*:*" ,
"matchCriteriaId" : "2E34F2B8-E790-4AC0-B730-E78310A9B65E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:2.1.0:rc4:*:*:*:*:*:*" ,
"matchCriteriaId" : "721FBF4B-72E0-4F9B-9F43-DFF4F8A1CFCE"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:3.0:beta1:*:*:*:*:*:*" ,
"matchCriteriaId" : "3949BA8A-8E9F-4E81-A76E-6003DDB7685F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:3.0:beta2:*:*:*:*:*:*" ,
"matchCriteriaId" : "3D0F46AE-E384-4AD4-AC2F-F131B7020F0A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:3.0:beta3:*:*:*:*:*:*" ,
"matchCriteriaId" : "DEFD2916-630C-405C-970B-2ABCA135FFF9"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:3.0:beta4:*:*:*:*:*:*" ,
"matchCriteriaId" : "369D0038-FBB8-4D23-A3E4-634E24BE78CF"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:nextapp:echo:3.0:beta5:*:*:*:*:*:*" ,
"matchCriteriaId" : "61C721E9-8F2A-4F61-8029-69F84632C670"
}
]
}
]
}
] ,
"references" : [
{
"url" : "http://echo.nextapp.com/site/node/5742" ,
"source" : "psirt@us.ibm.com" ,
"tags" : [
"Vendor Advisory"
]
} ,
2024-04-04 08:46:00 +00:00
{
"url" : "http://secunia.com/advisories/34218" ,
"source" : "psirt@us.ibm.com" ,
"tags" : [
"Vendor Advisory"
]
} ,
2023-04-24 12:24:31 +02:00
{
"url" : "http://www.exploit-db.com/exploits/8191/" ,
"source" : "psirt@us.ibm.com" ,
"tags" : [
"Exploit"
]
} ,
{
"url" : "http://www.securityfocus.com/archive/1/501637/100/0/threaded" ,
"source" : "psirt@us.ibm.com"
} ,
{
"url" : "http://www.vupen.com/english/advisories/2009/0653" ,
"source" : "psirt@us.ibm.com"
} ,
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/49167" ,
"source" : "psirt@us.ibm.com"
} ,
{
"url" : "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20090305-0_echo_nextapp_xml_injection.txt" ,
"source" : "psirt@us.ibm.com" ,
"tags" : [
"Exploit"
]
2024-12-08 03:06:42 +00:00
} ,
{
"url" : "http://echo.nextapp.com/site/node/5742" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Vendor Advisory"
]
} ,
{
"url" : "http://secunia.com/advisories/34218" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Vendor Advisory"
]
} ,
{
"url" : "http://www.exploit-db.com/exploits/8191/" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Exploit"
]
} ,
{
"url" : "http://www.securityfocus.com/archive/1/501637/100/0/threaded" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108"
} ,
{
"url" : "http://www.vupen.com/english/advisories/2009/0653" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108"
} ,
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/49167" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108"
} ,
{
"url" : "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20090305-0_echo_nextapp_xml_injection.txt" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Exploit"
]
2023-04-24 12:24:31 +02:00
}
]
}
