PT-2019-14568 · Hcl · Hcl Appscan Source

Published 2019-09-25 · Updated 2019-09-26 · CVE-2019-16188

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions HCL AppScan Source versions prior to 9.03.13

Description The issue allows for XML External Entity (XXE) attacks, which can lead to information disclosure and denial of service attacks. An attacker can send a specially crafted .ozasmt file to a victim, and when the victim imports this file, the content of any local file (accessible to the victim) can be exfiltrated to a remote listener controlled by the attacker. This is due to the product not disabling external XML Entity Processing.

Recommendations For versions prior to 9.03.13, update to version 9.03.13 or later to resolve the issue. As a temporary workaround, consider disabling the import of .ozasmt files until a patch is applied. Restrict access to sensitive files and directories to minimize the risk of information disclosure.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2019-16188

Affected Products

Hcl Appscan Source

References · 3

• https://hclpnpsupport.hcltech.com/csm?id=kb_article&sys_id=0812a9961b0c885077761fc58d4bcb06 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16188 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16188 · Vendor Advisory