CVEvulnerability
CVE-2015-3160
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-09-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 4.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-611
Description
XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submitting job XML to the server containing entity references which reference files from the Beaker server's file system.
Affected configurations
• beaker-project beaker (<= 20.0)
Related
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- http://www.openwall.com/lists/oss-security/2015/05/08/1 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/74569 Third Party Advisory, VDB Entry
- https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html#beaker-20-1 Release Notes, Vendor Advisory
- https://bugzilla.redhat.com/attachment.cgi?id=1020003 Issue Tracking, Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1215020 Issue Tracking, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2015/05/08/1 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/74569 Third Party Advisory, VDB Entry
- https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html#beaker-20-1 Release Notes, Vendor Advisory
- https://bugzilla.redhat.com/attachment.cgi?id=1020003 Issue Tracking, Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1215020 Issue Tracking, Third Party Advisory, VDB Entry