CVE-2016-5748

EPSS 0.35%
Veröffentlicht 23.03.2017 06:59:00
Zuletzt bearbeitet 13.05.2026 00:24:29
Erkennungen
Login

External Entity Processing (XXE) vulnerability in the "risk score" application of NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to disclose the content of local files to logged-in users.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

NVD 5 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Netiq ≫ Access Manager Version 4.1

Netiq ≫ Access Manager Version 4.1 Update sp1

Netiq ≫ Access Manager Version 4.1 Update sp2

Netiq ≫ Access Manager Version 4.2

Netiq ≫ Access Manager Version 4.2 Update sp1

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.35%	0.262

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	5.5	1.8	3.6	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST	2.1	3.9	2.9	AV:L/AC:L/Au:N/C:P/I:N/A:N

CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

https://www.novell.com/support/kb/doc.php?id=7017797

https://nvd.nist.gov/vuln/detail/CVE-2016-5748

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2016-5748

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2016-5748

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2016-5748