PT-2021-18009 · Perforce · Perforce Helix Alm

Emanuele Barbeno · Published 2021-04-13 · Updated 2022-05-03 · CVE-2021-28973

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Perforce Helix ALM version 2020.3.1 Build 22

Description: The XML Import functionality of the Administration console in Perforce Helix ALM is vulnerable to XXE attacks due to insecurely configured software components that parse XML input data.

Recommendations: For Perforce Helix ALM version 2020.3.1 Build 22, consider disabling the XML Import functionality in the Administration console until a patch is available to prevent potential XXE attacks.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-28973

Affected Products

Perforce Helix Alm

References · 3

• 🔥 https://compass-security.com/fileadmin/Research/Advisories/2021-01_CSNC-2021-005_Helix_ALM_XXE.txt · Exploit
• https://osv.dev/vulnerability/CVE-2021-28973 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28973 · Security Note