PT-2017-9590 · Huawei · Huawei Anyoffice

Publicado 2017-04-02 · Atualizado 2017-04-05 · CVE-2016-8275

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Huawei AnyOffice version V200R006C00

Description The issue allows an authenticated, remote attacker to cause the software to deny services by uploading an XML bomb.

Recommendations For version V200R006C00, consider restricting the upload of XML files or implementing validation checks to prevent XML bombs until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-8275

Produtos afetados

Huawei Anyoffice

Referências · 4

• https://osv.dev/vulnerability/CVE-2016-8275 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-8275 · Nota de Segurança
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20160907-01-anyoffice-en · Aviso do Fabricante
• http://securityfocus.com/bid/93010 · Nota