Vulnerability in HP Network Node Manager I
CVE-2011-1483
wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
EPSS: 0.027 (84.7th percentile) — read the EPSS interpretation.
Affected products
- Hp Network_node_manager_i — versions 9.0, 9.01, 9.02
- Redhat Jboss_communications_platform — versions 1.2.11, 5.1.1
- Redhat Jboss_enterprise_application_platform — versions 4.2.0, 4.3.0, 5.1.1
- Redhat Jboss_enterprise_brms_platform — versions 5.1.0
- Redhat Jboss_enterprise_portal_platform — versions 4.3.0, 5.1.1
- Redhat Jboss_enterprise_soa_platform — versions 4.2.0, 4.3.0, 5.1.0
- Redhat Jboss_enterprise_web_platform — versions 5.1.1
- N/a — versions n/a
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_CONFIRM, Patch)
- secalert@redhat.com (x_refsource_HP, vendor-advisory)
- secalert@redhat.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2011-1483?
- CVE-2011-1483 is a vulnerability in HP Network Node Manager I. Published 2013-07-29.
- Is CVE-2011-1483 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.