Beaker CVE-2015-3160 XML External Entity Injection Vulnerability

Bugtraq ID:	74569
Class:	Input Validation Error
CVE:	CVE-2015-3160
Remote:	Yes
Local:	No
Published:	May 07 2015 12:00AM
Updated:	May 07 2015 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Beaker Project Beaker 20.0 Beaker Project Beaker 19.0
Not Vulnerable:	Beaker Project Beaker 20.1

Beaker CVE-2015-3160 XML External Entity Injection Vulnerability

Beaker is prone to an XML external entity injection because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker can exploit this issue to gain sensitive information. Other attacks are also possible.

Beaker CVE-2015-3160 XML External Entity Injection Vulnerability

An attacker can exploit this issue using readily available tools.

Beaker CVE-2015-3160 XML External Entity Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Beaker CVE-2015-3160 XML External Entity Injection Vulnerability

References:

• Beaker Homepage (Beaker Project)
  
• Beaker is vulnerable to "XXE" attacks from authenticated users, due to external (Red Hat)