PT-2020-14958 · Nec · Nec Expresscluster

Rgod · Published 2020-09-08 · Updated 2020-09-15 · CVE-2020-17408

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NEC ExpressCluster version 4.1

Description This issue allows remote attackers to disclose sensitive information on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the clpwebmc executable, due to the improper restriction of XML External Entity (XXE) references. A specially-crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this issue to disclose information in the context of SYSTEM.

Recommendations For NEC ExpressCluster version 4.1, consider restricting access to the clpwebmc executable until a patch is available. As a temporary workaround, avoid using the XML External Entity references in the affected executable to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-17408

ZDI-20-1102

Affected Products

Nec Expresscluster

References · 4

• https://osv.dev/vulnerability/CVE-2020-17408 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-20-1102 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-17408 · Security Note
• https://support.nec.co.jp/en/View.aspx?id=9510100319 · Vendor Advisory