PT-2019-14568 · Hcl · Hcl Appscan Source

Publicado 2019-09-25 · Atualizado 2019-09-26 · CVE-2019-16188

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions HCL AppScan Source versions prior to 9.03.13

Description The issue allows for XML External Entity (XXE) attacks, which can lead to information disclosure and denial of service attacks. An attacker can send a specially crafted .ozasmt file to a victim, and when the victim imports this file, the content of any local file (accessible to the victim) can be exfiltrated to a remote listener controlled by the attacker. This is due to the product not disabling external XML Entity Processing.

Recommendations For versions prior to 9.03.13, update to version 9.03.13 or later to resolve the issue. As a temporary workaround, consider disabling the import of .ozasmt files until a patch is applied. Restrict access to sensitive files and directories to minimize the risk of information disclosure.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2019-16188

Produtos afetados

Hcl Appscan Source

Referências · 3

• https://hclpnpsupport.hcltech.com/csm?id=kb_article&sys_id=0812a9961b0c885077761fc58d4bcb06 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-16188 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-16188 · Aviso do Fabricante