CVE-2015-3160

XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submitting job XML to the server containing entity references which reference files from the Beaker server's file system.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
VendorProductVersion
beaker-projectbeaker
𝑥
≤ 20.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2015/05/08/1
http://www.securityfocus.com/bid/74569
https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html#beaker-20-1
https://bugzilla.redhat.com/attachment.cgi?id=1020003
https://bugzilla.redhat.com/show_bug.cgi?id=1215020
http://www.openwall.com/lists/oss-security/2015/05/08/1
http://www.securityfocus.com/bid/74569
https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html#beaker-20-1
https://bugzilla.redhat.com/attachment.cgi?id=1020003
https://bugzilla.redhat.com/show_bug.cgi?id=1215020