CVEvulnerability
CVE-2014-4814
3.5 LOW
Official page ↗
- Status
- Modified
- Published
- 2014-10-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:N/A:P
- Weaknesses
- CWE-399
Description
IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 does not properly detect recursion during entity expansion, which allows remote authenticated users to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Affected configurations
• ibm websphere portal 6.1.0.0
• ibm websphere portal 6.1.0.1
• ibm websphere portal 6.1.0.2
• ibm websphere portal 6.1.0.3
• ibm websphere portal 6.1.0.4
• ibm websphere portal 6.1.0.5
• ibm websphere portal 6.1.0.6
• ibm websphere portal 6.1.5.0
• ibm websphere portal 6.1.5.1
• ibm websphere portal 6.1.5.2
• ibm websphere portal 6.1.5.3
• ibm websphere portal 7.0.0.0
• ibm websphere portal 7.0.0.1
• ibm websphere portal 7.0.0.2
• ibm websphere portal 8.0.0.0
• ibm websphere portal 8.0.0.1
• ibm websphere portal 8.5.0.0
Related
Weakness · not in database (1)
References
- http://secunia.com/advisories/59740 secunia.com
- http://www-01.ibm.com/support/docview.wss?uid=swg1PI24622 www-01.ibm.com
- http://www-01.ibm.com/support/docview.wss?uid=swg21684651 Patch, Vendor Advisory
- http://www.securityfocus.com/bid/70758 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95391 exchange.xforce.ibmcloud.com
- http://secunia.com/advisories/59740 secunia.com
- http://www-01.ibm.com/support/docview.wss?uid=swg1PI24622 www-01.ibm.com
- http://www-01.ibm.com/support/docview.wss?uid=swg21684651 Patch, Vendor Advisory
- http://www.securityfocus.com/bid/70758 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95391 exchange.xforce.ibmcloud.com