PT-2023-13658 · Güralp · Güralp Man-Eam-0003

CVE-2022-38840 · Publicado 2023-04-16 · Atualizado 2023-04-25

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Güralp MAN-EAM-0003 version 3.2.4

Description The issue is related to an XML External Entity (XXE) problem via XML file upload, which can lead to local file disclosure. This occurs in the cgi-bin/xmlstatus.cgi component.

Recommendations For Güralp MAN-EAM-0003 version 3.2.4, consider disabling the XML file upload feature in cgi-bin/xmlstatus.cgi until a patch is available to prevent local file disclosure.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2022-38840

Produtos afetados

Güralp Man-Eam-0003

Referências · 7

• 🔥 https://exploit-db.com/exploits/51037 · Exploit
• 🔥 http://packetstormsecurity.com/files/171439/MAN-EAM-0003-3.2.4-XML-Injection.html · Exploit
• 🔥 https://drive.google.com/drive/folders/1UG5IcL8fFp9MV0vjd78_cx6iXKda5bpM?usp=sharing · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-38840 · Nota de Segurança
• https://t.me/cvenotify/48363 · Publicação no Telegram
• https://t.me/cibsecurity/62259 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-38840 · Aviso do Fabricante