PT-2022-11609 · Unknown · Visam Vbase

Michael Heinzl · Published 2022-07-27 · Updated 2022-08-05 · CVE-2021-42537

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VISAM VBASE version 11.6.0.6

Description The issue arises when VISAM VBASE processes an XML document containing XML entities with URIs that resolve to documents outside of the intended sphere of control. This causes the product to embed incorrect documents into its output.

Recommendations For VISAM VBASE version 11.6.0.6, consider restricting the processing of XML entities with external URIs to prevent the embedding of incorrect documents into the output. As a temporary workaround, restrict access to external documents to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-42537

Affected Products

Visam Vbase

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-42537 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42537 · Vendor Advisory
• https://t.me/cibsecurity/47138 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-21-308-01 · Note