CVE-2015-3160 XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submitting job XML to the server containing en...
MediumCVSS 4.3
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submitting job XML to the server containing entity references which reference files from the Beaker server's file system.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| beaker-project beaker | <= 20.0 | No fix listed |
References
- [oss-security] 20150507 beaker vulns fixed in version 20.1 mailing-list third-party-advisory
- 74569 third-party-advisory vdb-entry
- beaker-project.org release-notes vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry