Vulnerability Details : CVE-2014-0854
The server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Vulnerability category: XML external entity (XXE) injection
Exploit prediction scoring system (EPSS) score for CVE-2014-0854
Probability of exploitation activity in the next 30 days: 0.27%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 64 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-0854
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2014-0854
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-0854
-
http://www-01.ibm.com/support/docview.wss?uid=swg21662856
IBM Security Bulletin: Multiple security exposures in IBM Cognos BI Server (CVE-2013-6954, CVE-2013-6732, CVE-2013-5802, CVE-2013-5825, CVE-2014-0854, CVE-2014-0861)Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/90794
IBM Cognos Business Intelligence XML external entity information disclosure CVE-2014-0854 Vulnerability Report
Products affected by CVE-2014-0854
- cpe:2.3:a:ibm:cognos_business_intelligence:8.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:cognos_business_intelligence:10.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:cognos_business_intelligence:10.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:cognos_business_intelligence:10.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:cognos_business_intelligence:10.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:cognos_business_intelligence:10.2.1.1:*:*:*:*:*:*:*