high7.8Public exploit code
CVE-2014-0644
EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external entity dec…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- EMC Cloud Tiering Appliance 10.0 - XML External Entity Arbitrary File Read (Metasploit)2014-03-31 · webapps · multiple
Impact
EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, as demonstrated by reading the /etc/shadow file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Emc | Cloud Tiering Appliance Software | Version 10.0 |
| Emc | Cloud Tiering Appliance | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html
- http://seclists.org/fulldisclosure/2014/Mar/426
- https://gist.github.com/brandonprry/9895721
- http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html
- http://seclists.org/fulldisclosure/2014/Mar/426
- https://gist.github.com/brandonprry/9895721