PT-2018-12542 · Ocs · Ocs Inventory Ng

Juan Manuel Fernandez · Publicado 2018-08-03 · Atualizado 2018-10-01 · CVE-2018-14473

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions OCS Inventory version 2.4.1

Description The issue is related to improper XML parsing configuration, which allows the use of external entities. This can be exploited by an attacker through a crafted HTTP request, potentially leading to information exfiltration or a Denial of Service.

Recommendations For OCS Inventory version 2.4.1, consider disabling the XML parsing functionality until a proper configuration or patch is available to prevent the exploitation of external entities.

Exploit

Correção

DoS

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2018-14473

Produtos afetados

Ocs Inventory Ng

Referências · 9

• 🔥 https://tarlogic.com/en/blog/vulnerabilities-in-ocs-inventory-2-4-1 · Exploit
• https://cve.org/CVERecord?id=CVE-2018-14473 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14473 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14473 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-14473 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14473 · Nota
• https://osv.dev/vulnerability/CVE-2018-14473 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-14473 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-14473 · Aviso do Fabricante