Vulnerability Details CVE-2014-4834
IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.8 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application crash) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.008
EPSS Ranking 72.0%
CVSS Severity
CVSS v2 Score 4.3
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR49897
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR50553
- http://www-01.ibm.com/support/docview.wss?uid=swg21685464
- http://www.securityfocus.com/bid/70870
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95628
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR49897
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR50553
- http://www-01.ibm.com/support/docview.wss?uid=swg21685464
- http://www.securityfocus.com/bid/70870
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95628
Products affected by CVE-2014-4834
-
cpe:2.3:a:ibm:websphere_commerce:6.0.0.0
-
cpe:2.3:a:ibm:websphere_commerce:6.0.0.1
-
cpe:2.3:a:ibm:websphere_commerce:6.0.0.10
-
cpe:2.3:a:ibm:websphere_commerce:6.0.0.11
-
cpe:2.3:a:ibm:websphere_commerce:6.0.0.2
-
cpe:2.3:a:ibm:websphere_commerce:6.0.0.3
-
cpe:2.3:a:ibm:websphere_commerce:6.0.0.4
-
cpe:2.3:a:ibm:websphere_commerce:6.0.0.5
-
cpe:2.3:a:ibm:websphere_commerce:6.0.0.6
-
cpe:2.3:a:ibm:websphere_commerce:6.0.0.7
-
cpe:2.3:a:ibm:websphere_commerce:6.0.0.8
-
cpe:2.3:a:ibm:websphere_commerce:6.0.0.9
-
cpe:2.3:a:ibm:websphere_commerce:7.0
-
cpe:2.3:a:ibm:websphere_commerce:7.0.0.1
-
cpe:2.3:a:ibm:websphere_commerce:7.0.0.2
-
cpe:2.3:a:ibm:websphere_commerce:7.0.0.3
-
cpe:2.3:a:ibm:websphere_commerce:7.0.0.4
-
cpe:2.3:a:ibm:websphere_commerce:7.0.0.5
-
cpe:2.3:a:ibm:websphere_commerce:7.0.0.6
-
cpe:2.3:a:ibm:websphere_commerce:7.0.0.7
-
cpe:2.3:a:ibm:websphere_commerce:7.0.0.8