PT-2019-9795 · Sdl · Sdl Web

Ahmed Elhady Mohamed + 1 · Published 2019-01-02 · Updated 2019-01-24 · CVE-2018-19371

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SDL Web version 8.5.0

Description The issue concerns an XXE vulnerability in the SaveUserSettings service of Content Manager, allowing unauthorized access to sensitive system files.

Recommendations For SDL Web version 8.5.0, update to a version that includes a fix for this issue, as using an XXE vulnerability can lead to sensitive data exposure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-19371

Affected Products

Sdl Web

References · 4

• 🔥 https://exploit-db.com/exploits/46000 · Exploit
• 🔥 http://packetstormsecurity.com/files/150826/SDL-Web-Content-Manager-8.5.0-XML-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-19371 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19371 · Vendor Advisory