CVE-2015-8549 - Vulnerability Details - OpenCVE

XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact Partial

AV:N/AC:M/Au:N/C:P/I:N/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Pyamf	Pyamf

Configuration 1 [-]

cpe:2.3:a:pyamf:pyamf:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.ocert.org/advisories/ocert-2015-011.html
http://www.securityfocus.com/archive/1/archive/1/537151/100/0/threaded
https://github.com/hydralabs/pyamf/pull/58
https://github.com/hydralabs/pyamf/releases/tag/v0.8.0

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2020-01-15T14:48:19

Updated: 2024-08-06T08:20:43.206Z

Reserved: 2015-12-14T00:00:00

Link: CVE-2015-8549

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-01-15T15:15:11.457

Modified: 2024-11-21T02:38:42.547

Link: CVE-2015-8549

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-12-17T00:00:00", "descriptions": [{"lang": "en", "value": "XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-01-15T14:48:19", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.ocert.org/advisories/ocert-2015-011.html"}, {"tags": ["x_refsource_MISC"], "url": "http://www.securityfocus.com/archive/1/archive/1/537151/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/hydralabs/pyamf/pull/58"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/hydralabs/pyamf/releases/tag/v0.8.0"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-8549", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.ocert.org/advisories/ocert-2015-011.html", "refsource": "MISC", "url": "http://www.ocert.org/advisories/ocert-2015-011.html"}, {"name": "http://www.securityfocus.com/archive/1/archive/1/537151/100/0/threaded", "refsource": "MISC", "url": "http://www.securityfocus.com/archive/1/archive/1/537151/100/0/threaded"}, {"name": "https://github.com/hydralabs/pyamf/pull/58", "refsource": "MISC", "url": "https://github.com/hydralabs/pyamf/pull/58"}, {"name": "https://github.com/hydralabs/pyamf/releases/tag/v0.8.0", "refsource": "MISC", "url": "https://github.com/hydralabs/pyamf/releases/tag/v0.8.0"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T08:20:43.206Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.ocert.org/advisories/ocert-2015-011.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/archive/1/537151/100/0/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/hydralabs/pyamf/pull/58"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/hydralabs/pyamf/releases/tag/v0.8.0"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-8549", "datePublished": "2020-01-15T14:48:19", "dateReserved": "2015-12-14T00:00:00", "dateUpdated": "2024-08-06T08:20:43.206Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pyamf:pyamf:*:*:*:*:*:*:*:*", "matchCriteriaId": "B39C1DE0-2B3E-4316-B300-F4509E56761A", "versionEndExcluding": "0.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload."}, {"lang": "es", "value": "Una vulnerabilidad de tipo XML external entity (XXE) en PyAMF versiones anteriores a 0.8.0, permite a atacantes remotos causar una denegaci\u00f3n de servicio o leer archivos arbitrarios por medio de una carga \u00fatil Action Message Format (AMF) dise\u00f1ada."}], "id": "CVE-2015-8549", "lastModified": "2024-11-21T02:38:42.547", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-01-15T15:15:11.457", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://www.ocert.org/advisories/ocert-2015-011.html"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://www.securityfocus.com/archive/1/archive/1/537151/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/hydralabs/pyamf/pull/58"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/hydralabs/pyamf/releases/tag/v0.8.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.ocert.org/advisories/ocert-2015-011.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://www.securityfocus.com/archive/1/archive/1/537151/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/hydralabs/pyamf/pull/58"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/hydralabs/pyamf/releases/tag/v0.8.0"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "nvd@nist.gov", "type": "Primary"}]}