PT-2016-7156 · Huawei · Huawei E9000+1

Publicado 2016-09-07 · Atualizado 2016-09-08 · CVE-2016-6898

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Média

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Huawei E9000 rack servers with software before V100R001C00SPC296

Description The issue is related to an XML external entity (XXE) vulnerability in the Hyper Management Module (HMM). This allows remote authenticated users to read arbitrary files or cause a denial of service, resulting in a web service outage, by sending a crafted XML document.

Recommendations For Huawei E9000 rack servers with software before V100R001C00SPC296, update to V100R001C00SPC296 or later to resolve the issue. As a temporary workaround, consider restricting access to the HMM to minimize the risk of exploitation.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-6898

Produtos afetados

Huawei E9000

Hyper Module Management

Referências · 4

• http://securityfocus.com/bid/92620 · Nota
• https://osv.dev/vulnerability/CVE-2016-6898 · Aviso do Fabricante
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20160824-01-e9000-en · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-6898 · Nota de Segurança