CVE-2014-5392
First published: Tue Sep 23 2014(Updated: )
XML External Entity (XXE) vulnerability in JobScheduler before 1.6.4246 and 7.x before 1.7.4241 allows remote attackers to cause a denial of service and read arbitrary files or directories via a request containing an XML external entity declaration in conjunction with an entity reference.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens Operation Scheduler | <=1.6.4131 | |
| Siemens Operation Scheduler | =1.6.4014 | |
| Siemens Operation Scheduler | =1.6.4043 | |
| Siemens Operation Scheduler | =1.7.4177 | |
| Siemens Operation Scheduler | =1.7.4189 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/128181/JobScheduler-XML-eXternal-Entity-Injection.html
- http://www.christian-schneider.net/advisories/CVE-2014-5392.txt
- http://www.securityfocus.com/archive/1/533374/100/0/threaded
- http://www.sos-berlin.com/modules/news/article.php?storyid=73
- https://change.sos-berlin.com/browse/JS-1204
Frequently Asked Questions
What is the severity of CVE-2014-5392?
CVE-2014-5392 has a high severity rating due to its ability to cause denial of service and allow unauthorized file access.
How do I fix CVE-2014-5392?
To fix CVE-2014-5392, upgrade to JobScheduler version 1.6.4246 or 1.7.4241 or later.
What types of attacks can exploit CVE-2014-5392?
Exploitation of CVE-2014-5392 can lead to denial of service and unauthorized reading of sensitive files.
Which versions of JobScheduler are affected by CVE-2014-5392?
JobScheduler versions before 1.6.4246 and 1.7.4241 are affected by CVE-2014-5392.
Is CVE-2014-5392 related to XML vulnerabilities?
Yes, CVE-2014-5392 is specifically an XML External Entity (XXE) vulnerability.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/last-modified-date
- agent/remedy
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/sos
- canonical/siemens operation scheduler
- version/siemens operation scheduler/1.6.4131
- version/siemens operation scheduler/1.6.4014
- version/siemens operation scheduler/1.6.4043
- version/siemens operation scheduler/1.7.4177
- version/siemens operation scheduler/1.7.4189