PT-2018-11194 · Fortify · Hp Fortify Software Security Center

Alex Hernandez + 1 · Published 2018-07-12 · Updated 2020-09-16 · CVE-2018-12463

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortify Software Security Center (SSC) versions 17.1 through 18.1

Description The issue allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks. This is achieved via a crafted DTD in an XML request, exploiting an XML external entity (XXE) vulnerability.

Recommendations For Fortify Software Security Center (SSC) versions 17.1 through 18.1, update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-12463

Affected Products

Hp Fortify Software Security Center

References · 6

• 🔥 https://github.com/alt3kx/CVE-2018-12463 · Exploit
• 🔥 https://exploit-db.com/exploits/45027 · Exploit
• https://osv.dev/vulnerability/CVE-2018-12463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12463 · Security Note
• http://securitytracker.com/id/1041286 · Note
• https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03201563 · Note