{"api_version":"1","generated_at":"2026-07-23T09:59:09+00:00","cve":"CVE-2014-3066","urls":{"html":"https://cve.report/CVE-2014-3066","api":"https://cve.report/api/cve/CVE-2014-3066.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-3066","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-3066"},"summary":{"title":"CVE-2014-3066","description":"IBM Tivoli Endpoint Manager 9.1 before 9.1.1088.0 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","state":"PUBLISHED","assigner":"ibm","published_at":"2014-07-02 10:35:25","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-200","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securitytracker.com/id/1030508","name":"http://www.securitytracker.com/id/1030508","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM Tivoli Endpoint Manager XXE Bug Lets Remote Users Obtain Files From the Target System - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21673967","name":"http://www-01.ibm.com/support/docview.wss?uid=swg21673967","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"IBM notice: The page you requested cannot be displayed","mime":"text/html","httpstatus":"404","archivestatus":"410"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/93630","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/93630","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21673961","name":"http://www-01.ibm.com/support/docview.wss?uid=swg21673961","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM notice: The page you requested cannot be displayed","mime":"text/html","httpstatus":"404","archivestatus":"410"},{"url":"http://secunia.com/advisories/58906","name":"http://secunia.com/advisories/58906","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA58906 - IBM Tivoli Endpoint Manager XXE Information Disclosure Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/58672","name":"http://secunia.com/advisories/58672","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA58672 - IBM Tivoli Endpoint Manager XXE Information Disclosure Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3066","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3066","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"3066","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"tivoli_endpoint_manager","cpe6":"9.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T10:35:55.646Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"58672","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/58672"},{"name":"58906","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/58906"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21673967"},{"name":"1030508","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1030508"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21673961"},{"name":"ibm-endpointmanager-cve20143066-xxe(93630)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/93630"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-06-25T00:00:00.000Z","descriptions":[{"lang":"en","value":"IBM Tivoli Endpoint Manager 9.1 before 9.1.1088.0 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"name":"58672","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/58672"},{"name":"58906","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/58906"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21673967"},{"name":"1030508","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1030508"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21673961"},{"name":"ibm-endpointmanager-cve20143066-xxe(93630)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/93630"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","ID":"CVE-2014-3066","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"IBM Tivoli Endpoint Manager 9.1 before 9.1.1088.0 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"58672","refsource":"SECUNIA","url":"http://secunia.com/advisories/58672"},{"name":"58906","refsource":"SECUNIA","url":"http://secunia.com/advisories/58906"},{"name":"http://www-01.ibm.com/support/docview.wss?uid=swg21673967","refsource":"CONFIRM","url":"http://www-01.ibm.com/support/docview.wss?uid=swg21673967"},{"name":"1030508","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1030508"},{"name":"http://www-01.ibm.com/support/docview.wss?uid=swg21673961","refsource":"CONFIRM","url":"http://www-01.ibm.com/support/docview.wss?uid=swg21673961"},{"name":"ibm-endpointmanager-cve20143066-xxe(93630)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/93630"}]}}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2014-3066","datePublished":"2014-07-02T10:00:00.000Z","dateReserved":"2014-04-29T00:00:00.000Z","dateUpdated":"2024-08-06T10:35:55.646Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-07-02 10:35:25","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-200","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:tivoli_endpoint_manager:9.1:*:*:*:*:*:*:*","matchCriteriaId":"63A12855-F1F3-48F2-940F-114D18605F7E"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"3066","Ordinal":"1","Title":"CVE-2014-3066","CVE":"CVE-2014-3066","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"3066","Ordinal":"1","NoteData":"IBM Tivoli Endpoint Manager 9.1 before 9.1.1088.0 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","Type":"Description","Title":"CVE-2014-3066"},{"CveYear":"2014","CveId":"3066","Ordinal":"2","NoteData":"2014-07-02","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"3066","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}