PT-2020-10354 · Determine · Determine Contract Lifecycle Management

Esteban Rodriguez · Published 2020-01-05 · Updated 2020-01-13 · CVE-2019-20153

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Determine Contract Lifecycle Management (CLM) version 5.4

Description An issue was discovered that allows authenticated remote attackers to read arbitrary files, including configuration files containing administrative credentials, due to an XML external entity (XXE) vulnerability in the upload definition feature in the definition upload attach.jsp file.

Recommendations For version 5.4, as a temporary workaround, consider restricting access to the definition upload attach.jsp file until a patch is available. Avoid using the upload definition feature in this version to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2019-20153

Affected Products

Determine Contract Lifecycle Management

References · 3

• 🔥 https://n00py.io/2020/01/zero-day-exploit-in-determine-selectica-contract-lifecycle-management-sclm-v5-4 · Exploit
• https://osv.dev/vulnerability/CVE-2019-20153 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20153 · Security Note