NVD

Id
32993  
Name
CVE-2014-5265  
Description
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-19  
Published
2014-08-18  
Modified Date
2015-11-25  
Seq
2014-5265  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
173182 32993 CVE-2014-5265 http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830  View
173183 32993 CVE-2014-5265 DSA-2999  View
173184 32993 CVE-2014-5265 DSA-3001  View
173185 32993 CVE-2014-5265 https://core.trac.wordpress.org/changeset/29404  View
173186 32993 CVE-2014-5265 https://wordpress.org/news/2014/08/wordpress-3-9-2/  View
173187 32993 CVE-2014-5265 https://www.drupal.org/SA-CORE-2014-004  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14974 JVNDB-2014-003849 WordPress および Drupal で使用される Incutio XML-RPC ライブラリにおけるサービス運用妨害 (DoS) の脆弱性 WordPress および Drupal で使用される Incutio XML-RPC (IXR) ライブラリは、エンティティの拡張中、再帰を考慮せずエンティティ宣言を許可するため、サービス運用妨害 (メモリおよび CPU 資源の消費) 状態にされる脆弱性が存在します。 CVE-2014-5265 72554 CVE-2014-5265 32993 5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003849.html 2014-08-06 2014-08-19 View