PT-2018-12542 · Ocs · Ocs Inventory Ng

Juan Manuel Fernandez · Published 2018-08-03 · Updated 2018-10-01 · CVE-2018-14473

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions OCS Inventory version 2.4.1

Description The issue is related to improper XML parsing configuration, which allows the use of external entities. This can be exploited by an attacker through a crafted HTTP request, potentially leading to information exfiltration or a Denial of Service.

Recommendations For OCS Inventory version 2.4.1, consider disabling the XML parsing functionality until a proper configuration or patch is available to prevent the exploitation of external entities.

Exploit

Fix

DoS

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-14473

Affected Products

Ocs Inventory Ng

References · 9

• 🔥 https://tarlogic.com/en/blog/vulnerabilities-in-ocs-inventory-2-4-1 · Exploit
• https://cve.org/CVERecord?id=CVE-2018-14473 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14473 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14473 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14473 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14473 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14473 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-14473 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14473 · Note