{"id":"CVE-2014-8162","aliases":["EUVD-2014-8003","GHSA-r4x8-hgr8-2fhj","RHSA-2015:0957","SUSE-SU-2015:0928-1","SUSE-SU-2015:0945-1"],"status":"published","title":"XML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5...","description":"XML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02674,"percentile":0.85868,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2014-09-29T23:11:22Z","modified":"2026-06-28T10:13:39Z","fixes":[{"ecosystem":"Red Hat:network_satellite:5.7::el6","package":"spacewalk-java","fixed_in":["0:2.3.8-103.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.7::el6","package":"spacewalk-java-config","fixed_in":["0:2.3.8-103.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.7::el6","package":"spacewalk-java-lib","fixed_in":["0:2.3.8-103.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.7::el6","package":"spacewalk-java-oracle","fixed_in":["0:2.3.8-103.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.7::el6","package":"spacewalk-java-postgresql","fixed_in":["0:2.3.8-103.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.7::el6","package":"spacewalk-setup","fixed_in":["0:2.3.0-17.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.7::el6","package":"spacewalk-taskomatic","fixed_in":["0:2.3.8-103.el6sat"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:network_satellite:5.7::el6","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.8-103.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.7::el6","package":"spacewalk-java-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.8-103.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.7::el6","package":"spacewalk-java-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.8-103.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.7::el6","package":"spacewalk-java-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.8-103.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.7::el6","package":"spacewalk-java-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.8-103.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.7::el6","package":"spacewalk-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-17.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.7::el6","package":"spacewalk-taskomatic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.8-103.el6sat"}]}]}],"products":[{"vendor":"redhat","product":"network_satellite"},{"vendor":"suse","product":"manager"}],"references":[{"url":"http://www.securityfocus.com/bid/74595","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0957.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00020.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8162","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0957","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8162","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1187339","tags":["report"]},{"url":"https://github.com/advisories/GHSA-r4x8-hgr8-2fhj"},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0957.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8162","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150928-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/799068","tags":["report"]},{"url":"https://bugzilla.suse.com/804456","tags":["report"]},{"url":"https://bugzilla.suse.com/806839","tags":["report"]},{"url":"https://bugzilla.suse.com/809722","tags":["report"]},{"url":"https://bugzilla.suse.com/809927","tags":["report"]},{"url":"https://bugzilla.suse.com/814954","tags":["report"]},{"url":"https://bugzilla.suse.com/841138","tags":["report"]},{"url":"https://bugzilla.suse.com/841139","tags":["report"]},{"url":"https://bugzilla.suse.com/841143","tags":["report"]},{"url":"https://bugzilla.suse.com/845533","tags":["report"]},{"url":"https://bugzilla.suse.com/847374","tags":["report"]},{"url":"https://bugzilla.suse.com/860782","tags":["report"]},{"url":"https://bugzilla.suse.com/860831","tags":["report"]},{"url":"https://bugzilla.suse.com/864246","tags":["report"]},{"url":"https://bugzilla.suse.com/870159","tags":["report"]},{"url":"https://bugzilla.suse.com/874645","tags":["report"]},{"url":"https://bugzilla.suse.com/879904","tags":["report"]},{"url":"https://bugzilla.suse.com/881111","tags":["report"]},{"url":"https://bugzilla.suse.com/883057","tags":["report"]},{"url":"https://bugzilla.suse.com/890660","tags":["report"]},{"url":"https://bugzilla.suse.com/896238","tags":["report"]},{"url":"https://bugzilla.suse.com/896244","tags":["report"]},{"url":"https://bugzilla.suse.com/898426","tags":["report"]},{"url":"https://bugzilla.suse.com/900956","tags":["report"]},{"url":"https://bugzilla.suse.com/901108","tags":["report"]},{"url":"https://bugzilla.suse.com/902915","tags":["report"]},{"url":"https://bugzilla.suse.com/903723","tags":["report"]},{"url":"https://bugzilla.suse.com/906850","tags":["report"]},{"url":"https://bugzilla.suse.com/912886","tags":["report"]},{"url":"https://bugzilla.suse.com/922525","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8162","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150945-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-8162","description":"XML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors.","status":"published","published":"2015-05-14T14:00:00Z","modified":"2024-08-06T13:10:50.969Z","updated_at":"2026-11-02T14:33:43.206348Z"}],"euvd":[{"id":"EUVD-2014-8003","description":"XML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors.","status":"published","published":"2015-05-14T14:00:00Z","modified":"2024-08-06T13:10:50Z","updated_at":"2026-11-03T01:56:52.951821Z"}],"ghsa":[{"id":"GHSA-r4x8-hgr8-2fhj","title":"XML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5...","description":"XML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors.","status":"published","published":"2022-05-17T03:45:51Z","modified":"2023-02-02T21:34:03Z","updated_at":"2026-11-02T14:52:47.993176Z"}],"nvd":[{"id":"CVE-2014-8162","description":"XML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors.","status":"published","published":"2015-05-14T14:59:05.653Z","modified":"2026-06-17T00:16:24.773Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:02:58.385843Z"}],"osv":[{"id":"RHSA-2015:0957","title":"Red Hat Security Advisory: spacewalk-java security update","status":"published","published":"2024-09-15T22:32:14Z","modified":"2026-06-28T10:13:39Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"SUSE-SU-2015:0928-1","title":"Recommended update for sm-ncc-sync-data","description":"\nThis update for sm-ncc-sync-data contains the following changes:\n\n    * Add SUSE Cloud 4 channels. (bnc#883057)\n    * Fix parent label of the LTSS channel for SLMS.\n\n","status":"published","published":"2014-09-29T23:11:22Z","modified":"2026-02-04T03:44:10.865006Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0945-1","title":"Security update for spacewalk-java, spacewalk-setup","description":"\nThe spacewalk-java and spacewalk-setup packages were updated to fix one \nsecurity issue:\n\n    * CVE-2014-8162: RPC API XML External Entities file disclosure.\n      (bsc#922525)\n\nSecurity Issues:\n\n    * CVE-2014-8162\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8162\u003e\n\n","status":"published","published":"2015-05-12T15:36:09Z","modified":"2026-02-04T03:58:16.645455Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}