CVE-2014-8162 XML external entity in n/a
Remote attackers can read arbitrary files via XML external entity injection in the RPC interface of Spacewalk and RHN Satellite.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-8162?
CVE-2014-8162 is a high-severity vulnerability in n/a, published on 14 May 2015. It can be exploited over the network, with no action from the victim.
Official description
XML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors.
Which versions are affected by CVE-2014-8162?
It affects 2 products.
Linux distribution packages (7)
spacewalk-java Red Hat:network_satellite:5.7::el6 | All versions | 0:2.3.8-103.el6sat |
spacewalk-java-config Red Hat:network_satellite:5.7::el6 | All versions | 0:2.3.8-103.el6sat |
spacewalk-java-lib Red Hat:network_satellite:5.7::el6 | All versions | 0:2.3.8-103.el6sat |
spacewalk-java-oracle Red Hat:network_satellite:5.7::el6 | All versions | 0:2.3.8-103.el6sat |
spacewalk-java-postgresql Red Hat:network_satellite:5.7::el6 | All versions | 0:2.3.8-103.el6sat |
spacewalk-setup Red Hat:network_satellite:5.7::el6 | All versions | 0:2.3.0-17.el6sat |
spacewalk-taskomatic Red Hat:network_satellite:5.7::el6 | All versions | 0:2.3.8-103.el6sat |
Products include Redhat Network Satellite, Suse Manager.
How do I fix CVE-2014-8162?
Apply the vendor's patch.
Is CVE-2014-8162 being exploited?
There is no known exploitation of CVE-2014-8162 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2013-4480 Missing authorization in n/a
- CVE-2013-2143 Missing authorization in n/a
- CVE-2011-1594 Spacewalk: spacewalk: open redirect vulnerability enables phishing attacks via url parameter
- CVE-2011-2920 Spacewalk: spacewalk: cross-site scripting vulnerability allows arbitrary web script execution.
- CVE-2011-2927 Spacewalk: spacewalk and red hat network satellite: cross-site scripting vulnerability via search forms
Sources
Also known as GHSA-r4x8-hgr8-2fhj, RHSA-2015:0957, SUSE-SU-2015:0945-1.