{
  "threat_severity" : "Moderate",
  "public_date" : "2016-03-15T00:00:00Z",
  "bugzilla" : {
    "description" : "XStream: enabled processing of external entities",
    "id" : "1321789",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1321789"
  },
  "cvss" : {
    "cvss_base_score" : "5.0",
    "cvss_scoring_vector" : "AV:N/AC:L/Au:N/C:P/I:N/A:N",
    "status" : "verified"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.3",
    "cvss3_scoring_vector" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-611",
  "details" : [ "Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.", "It was found that several XML parsers used by XStream had default settings that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks." ],
  "affected_release" : [ {
    "product_name" : "Red Hat JBoss BPMS 6.3",
    "release_date" : "2016-11-28T00:00:00Z",
    "advisory" : "RHSA-2016:2822",
    "cpe" : "cpe:/a:redhat:jboss_bpms:6.3"
  }, {
    "product_name" : "Red Hat JBoss BRMS 6.3",
    "release_date" : "2016-11-28T00:00:00Z",
    "advisory" : "RHSA-2016:2823",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_brms_platform:6.3"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat BPM Suite 6",
    "fix_state" : "Affected",
    "package_name" : "xstream",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_bpms_platform"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "xstream",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Virtualization 3",
    "fix_state" : "Affected",
    "package_name" : "jasperreports-server-pro",
    "cpe" : "cpe:/a:redhat:enterprise_linux:7::hypervisor"
  }, {
    "product_name" : "Red Hat JBoss A-MQ 6.2.1",
    "fix_state" : "Affected",
    "package_name" : "xstream",
    "cpe" : "cpe:/a:jboss_amq:6.2.1"
  }, {
    "product_name" : "Red Hat JBoss BRMS 5",
    "fix_state" : "Will not fix",
    "package_name" : "xstream",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_brms_platform:5"
  }, {
    "product_name" : "Red Hat JBoss BRMS 6",
    "fix_state" : "Affected",
    "package_name" : "xstream",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_brms_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Data Grid 6",
    "fix_state" : "Affected",
    "package_name" : "xstream",
    "cpe" : "cpe:/a:redhat:jboss_data_grid:6"
  }, {
    "product_name" : "Red Hat JBoss Fuse Service Works 6",
    "fix_state" : "Affected",
    "package_name" : "xstream",
    "cpe" : "cpe:/a:redhat:jboss_fuse_service_works:6"
  }, {
    "product_name" : "Red Hat JBoss Portal 6",
    "fix_state" : "Affected",
    "package_name" : "xstream",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_portal_platform:6"
  }, {
    "product_name" : "Red Hat JBoss SOA Platform 5",
    "fix_state" : "Will not fix",
    "package_name" : "xstream",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_soa_platform:5"
  }, {
    "product_name" : "Red Hat OpenShift Enterprise 2",
    "fix_state" : "Affected",
    "package_name" : "xstream",
    "cpe" : "cpe:/a:redhat:openshift:2"
  }, {
    "product_name" : "Red Hat Satellite 6",
    "fix_state" : "Affected",
    "package_name" : "xstream",
    "cpe" : "cpe:/a:redhat:satellite:6"
  }, {
    "product_name" : "Red Hat Software Collections",
    "fix_state" : "Affected",
    "package_name" : "maven30-xstream",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:2"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2016-3674\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-3674\nhttps://github.com/x-stream/xstream/issues/25" ],
  "name" : "CVE-2016-3674",
  "csaw" : false
}