CVE-2015-5970
The ChangePassword RPC method in Novell ZENworks Configuration Management (ZCM) 11.3 and 11.4 allows remote attackers to conduct XPath injection attacks, and read arbitrary text files, via a malformed query involving a system entity reference.
- Score
- CVSS 3.0 5.3 Medium
- Status
- Modified - security@opentext.com
- Published
- 2016-02-18
- Last modified
- 2024-08-06
- Weaknesses
- CWE-94
Affected products
References
- http://www.zerodayinitiative.com/advisories/ZDI-16-167
- https://www.novell.com/support/kb/doc.php?id=7017240
