PT-2017-13033 · Lansweeper · Lansweeper

Publicado 2017-10-10 · Atualizado 2017-11-05 · CVE-2017-13706

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lansweeper versions prior to 6.0.100.67

Description The issue allows remote authenticated users to obtain sensitive information, cause a denial of service, conduct server-side request forgery (SSRF) attacks, conduct internal port scans, or have unspecified other impact via an XML request. This is due to an XML external entity (XXE) vulnerability in the import package functionality of the deployment module.

Recommendations For versions prior to 6.0.100.67, update to version 6.0.100.67 or later to resolve the issue. As a temporary workaround, consider restricting access to the import package functionality in the deployment module to minimize the risk of exploitation.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2017-13706

Produtos afetados

Lansweeper

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-13706 · Nota de Segurança
• https://lansweeper.com/changelog.aspx · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2017/Oct/14 · Nota
• https://osv.dev/vulnerability/CVE-2017-13706 · Aviso do Fabricante
• http://packetstormsecurity.com/files/144527/Lansweeper-6.0.100.29-XXE-Injection.html · Nota