CVE-2014-6114 XML external entity in n/a
Remote attackers can read arbitrary files via XML External Entity injection in IBM WebSphere Operational Decision Management.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-6114?
CVE-2014-6114 is a medium-severity vulnerability in n/a, published on 11 Dec 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Hosted Transparent Decision Service in the Rule Execution Server in IBM WebSphere ILOG JRules 7.1 before MP1 FP5 IF43; WebSphere Operational Decision Management 7.5 before FP3 IF41; and Operational Decision Manager 8.0 before MP1 FP2 IF34, 8.5 before MP1 FP1 IF43, and 8.6 before IF8 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Weakness: CWE-200
Which versions are affected by CVE-2014-6114?
It affects 3 products.
Products include Ibm Operational Decision Manager, Ibm Websphere Ilog Jrules, Ibm Websphere Operational Decision Management.
How do I fix CVE-2014-6114?
No fix has been published for CVE-2014-6114 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-6114 being exploited?
There is no known exploitation of CVE-2014-6114 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2024-22320 IBM Operational Decision Manager code execution
- CVE-2024-22319 IBM Operational Decision Manager JDNI injection
- CVE-2025-2824 IBM Operational Decision Manager HTTP open redirect
- CVE-2018-1821 XML external entity in Operational Decision Management
- CVE-2025-1551 IBM Operational Decision Manager cross-site scripting
Sources
Also known as GHSA-73gm-6p92-7hc9.