PT-2017-9590 · Huawei · Huawei Anyoffice

Published 2017-04-02 · Updated 2017-04-05 · CVE-2016-8275

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Huawei AnyOffice version V200R006C00

Description The issue allows an authenticated, remote attacker to cause the software to deny services by uploading an XML bomb.

Recommendations For version V200R006C00, consider restricting the upload of XML files or implementing validation checks to prevent XML bombs until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-8275

Affected Products

Huawei Anyoffice

References · 4

• https://osv.dev/vulnerability/CVE-2016-8275 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8275 · Security Note
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20160907-01-anyoffice-en · Vendor Advisory
• http://securityfocus.com/bid/93010 · Note