cve-2014-3005
Vulnerability from cvelistv5
Published
2018-02-01 17:00
Modified
2024-08-06 10:28
Severity ?
Summary
XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.
Impacted products
n/an/a
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:28:46.259Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2014-7594",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134885.html"
          },
          {
            "name": "68075",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/68075"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.zabbix.com/browse/ZBX-8151"
          },
          {
            "name": "FEDORA-2014-7603",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134909.html"
          },
          {
            "name": "20140617 [CVE-2014-3005]Zabbix 1.8.x-2.2.x Local File Inclusion via XXE Attack",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2014/Jun/87"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1110496"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://web.archive.org/web/20140622034155/http://www.pnigos.com:80/?p=273"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-04-25T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-02-01T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "FEDORA-2014-7594",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134885.html"
        },
        {
          "name": "68075",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/68075"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.zabbix.com/browse/ZBX-8151"
        },
        {
          "name": "FEDORA-2014-7603",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134909.html"
        },
        {
          "name": "20140617 [CVE-2014-3005]Zabbix 1.8.x-2.2.x Local File Inclusion via XXE Attack",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2014/Jun/87"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1110496"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://web.archive.org/web/20140622034155/http://www.pnigos.com:80/?p=273"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-3005",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "FEDORA-2014-7594",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134885.html"
            },
            {
              "name": "68075",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/68075"
            },
            {
              "name": "https://support.zabbix.com/browse/ZBX-8151",
              "refsource": "CONFIRM",
              "url": "https://support.zabbix.com/browse/ZBX-8151"
            },
            {
              "name": "FEDORA-2014-7603",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134909.html"
            },
            {
              "name": "20140617 [CVE-2014-3005]Zabbix 1.8.x-2.2.x Local File Inclusion via XXE Attack",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2014/Jun/87"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1110496",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1110496"
            },
            {
              "name": "https://web.archive.org/web/20140622034155/http://www.pnigos.com:80/?p=273",
              "refsource": "MISC",
              "url": "https://web.archive.org/web/20140622034155/http://www.pnigos.com:80/?p=273"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-3005",
    "datePublished": "2018-02-01T17:00:00",
    "dateReserved": "2014-04-25T00:00:00",
    "dateUpdated": "2024-08-06T10:28:46.259Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-3005\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2018-02-01T17:29:00.463\",\"lastModified\":\"2018-02-21T14:57:16.407\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad XEE (XML External Entity) en Zabbix 1.8.x anteriores a 1.8.21rc1, 2.0.x anteriores a 2.0.13rc1, 2.2.x anteriores a 2.2.5rc1 y 2.3.x anteriores a 2.3.2 permite que los atacantes remotos lean archivos arbitrarios o puedan ejecutar c\u00f3digo arbitrario mediante un DTD manipulado en una petici\u00f3n XML.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":7.5},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-611\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD5EC94A-383D-45A5-A1BC-5F14D54FD588\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B024F97A-00AA-449D-8726-03D9E6B89541\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CEF7DE3-7A87-4283-A7DF-FD57823C8F47\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D4332A9-1D31-41BB-B374-369C583639E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF5BE8CC-AC6B-4F9F-9717-26931F524092\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31ED07A1-8964-4B11-86D3-066380AC1D68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"26CEC79F-7007-42DB-8AA1-6688DC778E29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FFA1AC45-209D-4374-B74F-9117C102C8FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"71FE763F-54F0-419C-BC21-D7405D0E941A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49C4A6C7-57E2-4BA6-A4A2-38104AAF70A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3CB90768-701E-422A-AB56-96F2E032E11C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE049360-8CDA-4B55-8317-0C66E28D67A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F9A15D8B-F01E-43E6-B878-6639DC1E87A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDCC20CF-3FE4-4157-AA4D-D2400CE17B6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7F23C63-E589-4F86-9695-AD31BCE7ACAF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1DB43122-15A6-4E76-852B-732E7111EBF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C79E3195-A556-41E0-AF0F-7D23075B8BC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"50F4E7B1-B47A-49F3-BA8A-F3B268FEEECA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7480E2E8-041B-4A44-90D9-DAC7E59DA059\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C7CBCA78-6B99-41F6-AE42-4CCCA07FA277\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:1.8.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F13AC45-73FB-4C6B-A802-E26C82FFA1E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A13691AD-76EE-461B-A5A8-C8433AC907CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7F5CFFB-7492-4E87-8B85-2EB99CE2A9EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"29ACE6F0-E3B4-4B9D-A40A-47B66BA81FA0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E538292A-0573-4F6E-8504-F86863AE1D04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8213C387-7A54-4C86-AB6C-DF72AA17EFD6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"20104F5A-C278-4426-AF62-FF652C242CBA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C31B0F7D-E0A5-4EB8-BEE6-963905C734A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"292B7BEC-B201-4415-8730-2424EF00B419\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C814F99F-93DF-410C-B0F8-4370F9950515\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"24B48111-3352-4F57-AD16-2DC04BA76735\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7822FDCC-B05B-4716-B75B-20C8C8286CE7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"65E9EC9B-C075-442C-8EB7-F1FFE877A05D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5A4EFC4-BF36-4564-9F0D-2E228C994F53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"325AF70A-3CAA-4CBA-8AA8-10604371EC48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D0E08EE-2948-4DB4-ACB3-649B8A268AF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"74B24B35-404C-482C-8B9D-175035851F5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"55E66537-F350-434F-BBCC-67D348260EB8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E369F7E-7BA8-4A13-A1AD-D270D6525F8F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"46AF9FCC-7512-48CD-BBAF-6F1A6F03CBF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:2.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9DC2C39-7A33-4C82-9956-0458BCFECE2D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5991814D-CA77-4C25-90D2-DB542B17E0AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF47C9F0-D8DA-4B55-89EB-9B2C9383ADB9\"}]}]}],\"references\":[{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134885.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134909.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2014/Jun/87\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/68075\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1110496\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://support.zabbix.com/browse/ZBX-8151\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://web.archive.org/web/20140622034155/http://www.pnigos.com:80/?p=273\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading...

Loading...

Loading...
  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.