CVE-2014-6114: Infoleak

Published Dec 11, 2014

Updated

The Hosted Transparent Decision Service in the Rule Execution Server in IBM WebSphere ILOG JRules 7.1 before MP1 FP5 IF43; WebSphere Operational Decision Management 7.5 before FP3 IF41; and Operational Decision Manager 8.0 before MP1 FP2 IF34, 8.5 before MP1 FP1 IF43, and 8.6 before IF8 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected Software

5 affected components

IBM Operational Decision Manager=8.0

IBM Operational Decision Manager=8.5

IBM Operational Decision Manager=8.6

IBM WebSphere ILOG JRules=7.1

IBM WebSphere Operational Decision Management=7.5

Event History

Dec 11, 2014

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-6114?

CVE-2014-6114 is classified as a high severity vulnerability.

How do I fix CVE-2014-6114?

To fix CVE-2014-6114, upgrade to the patched version of IBM WebSphere Operational Decision Management or IBM WebSphere ILOG JRules as specified in the security advisory.

Which versions are affected by CVE-2014-6114?

CVE-2014-6114 affects IBM WebSphere ILOG JRules 7.1 and WebSphere Operational Decision Management versions 7.5, 8.0, 8.5, and 8.6 prior to their respective fixed versions.

What is the impact of exploiting CVE-2014-6114?

Exploiting CVE-2014-6114 could allow an attacker to gain unauthorized access to sensitive decision service functionalities.

Is there a workaround for CVE-2014-6114?

There are no known workarounds for CVE-2014-6114 other than applying the available patches.