PT-2015-5723 · Huawei · Seq Analyst

Uceka + 1 · Published 2015-05-18 · Updated 2016-12-03 · CVE-2015-2346

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Huawei SEQ Analyst versions prior to V200R002C03LG0001CP0022

Description The issue allows remote authenticated users to read arbitrary files. This is achieved via the req parameter, which is vulnerable to XML external entity (XXE) attacks.

Recommendations For versions prior to V200R002C03LG0001CP0022, update to V200R002C03LG0001CP0022 or later to resolve the issue. As a temporary workaround, consider restricting access to the req parameter to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2015-2346

Affected Products

Seq Analyst

References · 3

• 🔥 http://seclists.org/fulldisclosure/2015/Apr/42 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2346 · Security Note
• http://packetstormsecurity.com/files/131459/Huawei-SEQ-Analyst-XXE-Injection.html · Note