PT-2017-13251 · Conserus · Conserus Image Repository

Published 2017-12-15 · Updated 2018-01-12 · CVE-2017-14101

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Conserus Image Repository archive solution version 2.1.1.105

Description A security issue was discovered in the Conserus Image Repository archive solution, allowing an unauthenticated user to exploit an XML External Entity (XXE) vulnerability. By sending a modified HTTP SOAP request to the vulnerable service, an attacker can gain arbitrary file read access to the local file system. Additionally, this exploit enables the transmission of the application service's account hashed credentials to a remote attacker.

Recommendations For Conserus Image Repository archive solution version 2.1.1.105, consider restricting access to the vulnerable service until a patch is available. As a temporary workaround, avoid using the SOAP request functionality that allows for the exploitation of the XXE vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-14101

Affected Products

Conserus Image Repository

References · 3

• https://osv.dev/vulnerability/CVE-2017-14101 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14101 · Security Note
• https://technical.nttsecurity.com/post/102emjg/conserus-image-repository-xml-external-entity-vulnerability · Note