Information disclosure in Ibm Tivoli Endpoint Manager
CVE-2014-3066
IBM Tivoli Endpoint Manager 9.1 before 9.1.1088.0 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Vulnerability class: Information Disclosure
EPSS: 0.024 (82.5th percentile) — read the EPSS interpretation.
Affected products
- Ibm Tivoli_endpoint_manager — versions 9.1
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@us.ibm.com (x_refsource_SECUNIA, third-party-advisory)
- psirt@us.ibm.com (x_refsource_SECUNIA, third-party-advisory)
- psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
- psirt@us.ibm.com (vdb-entry, x_refsource_SECTRACK)
- psirt@us.ibm.com (x_refsource_CONFIRM)
- psirt@us.ibm.com (vdb-entry, x_refsource_XF)