CVE-2015-5970: Novell Zenworks Configuration Management

Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days.

The ChangePassword RPC method in Novell ZENworks Configuration Management (ZCM) 11.3 and 11.4 allows remote attackers to conduct XPath injection attacks, and read arbitrary text files, via a malformed query involving a system entity reference.

Affected products

• Novell Zenworks Configuration Management: version 11.3.0 only; version 11.3.1 only; version 11.3.2 only; version 11.4.0 only; version 11.4.1 only

Published 2016-02-18. Last modified 2026-06-17.