CVE-2015-5970 XML external entity in n/a

What is CVE-2015-5970?

CVE-2015-5970 is a medium-severity vulnerability in n/a, published on 18 Feb 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The ChangePassword RPC method in Novell ZENworks Configuration Management (ZCM) 11.3 and 11.4 allows remote attackers to conduct XPath injection attacks, and read arbitrary text files, via a malformed query involving a system entity reference.

Weakness: CWE-94

Which versions are affected by CVE-2015-5970?

It affects 1 product.

Products include Novell Zenworks Configuration Management.

How do I fix CVE-2015-5970?

No fix has been published for CVE-2015-5970 yet. Limit exposure of the affected software until one is available.

Is CVE-2015-5970 being exploited?

There is no known exploitation of CVE-2015-5970 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2010-5323 Path traversal in n/a Critical 10.0
• CVE-2010-5324 Path traversal in n/a Critical 10.0
• CVE-2015-0779 Path traversal in n/a Critical 10.0
• CVE-2013-6345 Other in n/a Critical 10.0
• CVE-2013-1080 Path traversal in n/a Critical 10.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-79wq-fqm7-crqp.