CVE-2014-2054
7.5
Vector
AV:N/AC:L/Au:N/C:P/I:P/A:P
Exploitability: 10.0 / Impact: 6.4
Source: NVD
Description
PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
Affected (19)
Products: Owncloud: Owncloud Server · Phpexcel Project: Phpexcel
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Version 6.0.0 |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 5.0.14 | |
| Up to 1.7.9 |
References (4)
Source: cve@mitre.org
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Timeline
No history available yet.