PT-2013-1309 · Vertiv · Liebert Sitescan

Evgeniy Ermakov + 1 · Publicado 2013-10-03 · Atualizado 2017-03-02 · CVE-2016-8348

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Liebert SiteScan versions prior to 6.5

Description The issue is related to an XML External Entity (XXE) problem, which is caused by incorrect restriction of XML links to external objects. This can allow a remote attacker to gain access to confidential information by using specially crafted XML requests. An attacker may enter malicious input to Liebert SiteScan through a weakly configured XML parser, causing the application to execute arbitrary code or disclose file contents from a server or connected network.

Recommendations For versions prior to 6.5, consider disabling the XML parser or restricting its use until a patch is available to prevent exploitation of the XXE issue. Restrict access to the Liebert SiteScan web interface to minimize the risk of exploitation. Avoid using weakly configured XML parsers in the Liebert SiteScan application until the issue is resolved.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2017-02208

CVE-2016-8348

Produtos afetados

Liebert Sitescan

Referências · 7

• http://securityfocus.com/bid/94587 · Nota
• https://osv.dev/vulnerability/CVE-2016-8348 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-16-334-01 · Nota
• http://securitylab.ru/lab/PT-2016-35 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-8348 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8348%20https://ics-cert.us-cert.gov/advisories/ICSA-16-334-01%20http://securityfocus.com/bid/94587 · Nota
• https://bdu.fstec.ru/vul/2017-02208 · Nota de Segurança