PT-2020-13203 · I Net · I-Net Clear Reports

Published 2020-07-15 · Updated 2020-07-22 · CVE-2020-12684

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions i-net Clear Reports versions 19.0.287

Description The issue occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser, allowing XXE injection. This can happen in i-net Clear Reports 2019, as used in i-net HelpDesk and other products.

Recommendations For version 19.0.287, consider reconfiguring the XML parser to properly handle external entities and prevent XXE injection. As a temporary workaround, restrict the processing of XML input containing external entity references until a more secure configuration or update is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-12684

Affected Products

I-Net Clear Reports

References · 5

• https://inetsoftware.de/documentation/clear-reports/release-notes/releases · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12684 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12684 · Vendor Advisory
• https://inetsoftware.de/documentation/clear-reports/release-notes/releases/changes_20.4 · Vendor Advisory
• https://t.me/cvenotify/5071 · Telegram Post