CVE-2015-5970

5.3MEDIUM

Key Information

Vendor: Novell
Status: Zenworks Configuration Management
Vendor: CVE Published:; 18 February 2016

Summary

The ChangePassword RPC method in Novell ZENworks Configuration Management (ZCM) 11.3 and 11.4 allows remote attackers to conduct XPath injection attacks, and read arbitrary text files, via a malformed query involving a system entity reference.

EPSS Score

13% chance of being exploited in the next 30 days.

CVSS V3.1

Score:

5.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
Feb 18, 2016
Vulnerability Reserved.
Aug 12, 2015

Collectors

NVD DatabaseMitre Database