PT-2018-11194 · Fortify · Hp Fortify Software Security Center

Alex Hernandez + 1 · Publicado 2018-07-12 · Atualizado 2020-09-16 · CVE-2018-12463

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortify Software Security Center (SSC) versions 17.1 through 18.1

Description The issue allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks. This is achieved via a crafted DTD in an XML request, exploiting an XML external entity (XXE) vulnerability.

Recommendations For Fortify Software Security Center (SSC) versions 17.1 through 18.1, update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2018-12463

Produtos afetados

Hp Fortify Software Security Center

Referências · 6

• 🔥 https://github.com/alt3kx/CVE-2018-12463 · Exploit
• 🔥 https://exploit-db.com/exploits/45027 · Exploit
• http://securitytracker.com/id/1041286 · Nota
• https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03201563 · Nota
• https://osv.dev/vulnerability/CVE-2018-12463 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-12463 · Nota de Segurança