{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-01T15:54:44.344","vulnerabilities":[{"cve":{"id":"CVE-2014-5398","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2014-08-28T01:55:03.607","lastModified":"2025-11-01T00:15:32.950","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."},{"lang":"es","value":"Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 hasta 5.5 permite a atacantes remotos leer ficheros arbitrarios o causar una denegación de servicio a través de una declaración de entidad externa XML en conjunto con una referencia de entidad, relacionado con un problema de entidad externa XML (XXE)."}],"metrics":{"cvssMetricV2":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:N/A:N","baseScore":2.1,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:N/A:N","baseScore":2.1,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]},{"source":"nvd@nist.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:invensys:wonderware_information_server:4.0:sp1:*:*:*:*:*:*","matchCriteriaId":"325DE4D6-7649-4566-BC6E-1F8DC16FF1A9"},{"vulnerable":true,"criteria":"cpe:2.3:a:invensys:wonderware_information_server:4.0:sp1:*:*:portal:*:*:*","matchCriteriaId":"C8A82967-0AEC-4C46-91D0-92CA332C9C86"},{"vulnerable":true,"criteria":"cpe:2.3:a:invensys:wonderware_information_server:4.5:-:portal:*:*:*:*:*","matchCriteriaId":"D7292C59-D289-4874-8385-B1B2C246F935"},{"vulnerable":true,"criteria":"cpe:2.3:a:invensys:wonderware_information_server:5.0:-:portal:*:*:*:*:*","matchCriteriaId":"8EA37129-F327-4EE6-B1FB-BFB0C3C68856"},{"vulnerable":true,"criteria":"cpe:2.3:a:invensys:wonderware_information_server:5.5:*:*:*:portal:*:*:*","matchCriteriaId":"FFBE9EBE-6678-4AFC-9052-8EC6B319EB7B"}]}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-238-02.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-14-238-02","source":"ics-cert@hq.dhs.gov"},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-14-238-02","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"]}],"evaluatorImpact":"Per: https://ics-cert.us-cert.gov/advisories/ICSA-14-238-02\n\n\"WIS may allow access to local resources (files and internal resources) via unsafe parsing of XML external entities. By using specially crafted XML files, an attacker can cause these products to send the contents of local remote resources to the attacker’s server or cause a denial of service of the system. This vulnerability is not exploitable remotely and cannot be exploited without user interaction. The exploit is only triggered when a local user runs the vulnerable application and loads the malformed XML files.\""}}]}