Unscored severity · published May 20, 2015
CVE-2014-8924
The server in IBM License Metric Tool 7.2.2 before IF15 and 7.5 before IF24 and Tivoli Asset Discovery for Distributed 7.2.2 before IF15 and 7.5 before IF24 allows remote…
–
CVSS
1.8%
EPSS
No
On KEV
Description
The server in IBM License Metric Tool 7.2.2 before IF15 and 7.5 before IF24 and Tivoli Asset Discovery for Distributed 7.2.2 before IF15 and 7.5 before IF24 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LM
License Metric Tool · Ibm
7.2.2; 7.5 · source: NVD
TA
Tivoli Asset Discovery For Distributed · Ibm
7.2.2; 7.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8924
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8924
Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21882820
www.securitytracker.com
http://www.securitytracker.com/id/1032275
More from License Metric Tool
9.8
CVE-2016-8964
IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials
8.4
CVE-2025-12985
License Service: Privilege escalation vulnerability
8.1
CVE-2016-8980
IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data
7.5
CVE-2023-43044
IBM License Metric Tool directory traversal
6.1
CVE-2016-8961
IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open redirect attack