PT-2019-9795 · Sdl · Sdl Web

Ahmed Elhady Mohamed + 1 · Publicado 2019-01-02 · Atualizado 2019-01-24 · CVE-2018-19371

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SDL Web version 8.5.0

Description The issue concerns an XXE vulnerability in the SaveUserSettings service of Content Manager, allowing unauthorized access to sensitive system files.

Recommendations For SDL Web version 8.5.0, update to a version that includes a fix for this issue, as using an XXE vulnerability can lead to sensitive data exposure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2018-19371

Produtos afetados

Sdl Web

Referências · 4

• 🔥 https://exploit-db.com/exploits/46000 · Exploit
• 🔥 http://packetstormsecurity.com/files/150826/SDL-Web-Content-Manager-8.5.0-XML-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-19371 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-19371 · Aviso do Fabricante