PT-2017-13033 · Lansweeper · Lansweeper

Published 2017-10-10 · Updated 2017-11-05 · CVE-2017-13706

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lansweeper versions prior to 6.0.100.67

Description The issue allows remote authenticated users to obtain sensitive information, cause a denial of service, conduct server-side request forgery (SSRF) attacks, conduct internal port scans, or have unspecified other impact via an XML request. This is due to an XML external entity (XXE) vulnerability in the import package functionality of the deployment module.

Recommendations For versions prior to 6.0.100.67, update to version 6.0.100.67 or later to resolve the issue. As a temporary workaround, consider restricting access to the import package functionality in the deployment module to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-13706

Affected Products

Lansweeper

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-13706 · Security Note
• https://lansweeper.com/changelog.aspx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-13706 · Vendor Advisory
• http://seclists.org/fulldisclosure/2017/Oct/14 · Note
• http://packetstormsecurity.com/files/144527/Lansweeper-6.0.100.29-XXE-Injection.html · Note