PT-2018-14021 · Iway · Iway Data Quality Suite Web Console

Mrr3Boot · Publicado 2018-09-26 · Atualizado 2018-12-17 · CVE-2018-17411

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iWay Data Quality Suite Web Console version 10.6.1.ga-2016-11-20

Description An XML External Entity (XXE) issue exists. This means that the software may be tricked into accessing resources or data it should not, potentially leading to information disclosure or other security issues.

Recommendations For iWay Data Quality Suite Web Console version 10.6.1.ga-2016-11-20, consider disabling XML external entities in the parser configuration as a temporary workaround until a patch is available.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2018-17411

Produtos afetados

Iway Data Quality Suite Web Console

Referências · 3

• 🔥 https://github.com/MrR3boot/CVE-Hunting/blob/master/iWay%20DQS%20XXE.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2018-17411 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17411 · Nota de Segurança