PT-2018-14021 · Iway · Iway Data Quality Suite Web Console

Mrr3Boot · Published 2018-09-26 · Updated 2018-12-17 · CVE-2018-17411

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iWay Data Quality Suite Web Console version 10.6.1.ga-2016-11-20

Description An XML External Entity (XXE) issue exists. This means that the software may be tricked into accessing resources or data it should not, potentially leading to information disclosure or other security issues.

Recommendations For iWay Data Quality Suite Web Console version 10.6.1.ga-2016-11-20, consider disabling XML external entities in the parser configuration as a temporary workaround until a patch is available.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-17411

Affected Products

Iway Data Quality Suite Web Console

References · 3

• 🔥 https://github.com/MrR3boot/CVE-Hunting/blob/master/iWay%20DQS%20XXE.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2018-17411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17411 · Security Note