CVE-2014-3005

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134885.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134909.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2014/Jun/87Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/68075Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1110496Issue Tracking, Third Party Advisory
https://support.zabbix.com/browse/ZBX-8151Exploit, Patch, Vendor Advisory
https://web.archive.org/web/20140622034155/http://www.pnigos.com:80/?p=273Exploit, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134885.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134909.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2014/Jun/87Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/68075Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1110496Issue Tracking, Third Party Advisory
https://support.zabbix.com/browse/ZBX-8151Exploit, Patch, Vendor Advisory
https://web.archive.org/web/20140622034155/http://www.pnigos.com:80/?p=273Exploit, Third Party Advisory

Timeline

Published: Feb 1, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-30066.8Sitepark Information Enterprise Server (IES) 2.9 before 2.9.6, when upgraded from an earlier version, does not properly restrict access, whi CVE-2014-300710.0Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharact CVE-2014-300810.0Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm param CVE-2014-30093.5The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management S CVE-2014-30104.3Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.2, 6.3 before 6.3.0.6, 7.0 CVE-2014-30115.0IBM OpenPages GRC Platform 6.1.0.1 before IF4 allows remote attackers to conduct link injection attacks via unspecified vectors.CVE-2014-30123.5Multiple CRLF injection vulnerabilities in IBM Curam Social Program Management 5.2 SP1 through 6.0.5.4 allow remote authenticated users to i CVE-2014-30133.5Multiple cross-site scripting (XSS) vulnerabilities in IBM Curam Social Program Management 4.5 SP10 through 6.0.5.4 allow remote authenticat CVE-2014-30143.5Cross-site scripting (XSS) vulnerability in the Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote aut CVE-2014-30156.8Cross-site request forgery (CSRF) vulnerability in the Web player in IBM Sametime Proxy Server and Web Client 9.0 through 9.0.0.1 allows rem CVE-2014-30187.8IBM BladeCenter SAS Connectivity Module (aka NSSM) and SAS RAID Module (aka RSSM) before 1.3.3.006 allow remote attackers to cause a denial CVE-2014-30195.0IBM BladeCenter SAS Connectivity Module (aka NSSM) and SAS RAID Module (aka RSSM) before 1.3.3.006 allow remote attackers to obtain blade an