CVE-2018-14473 - OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities

Back Back to CVE browser

CRITICAL

OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities

Published Aug 3, 2018

9.1

CRITICAL

CVSS 3.0

EPSS 3.07%

Description

OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. This issue can be exploited by an attacker sending a crafted HTTP request in order to exfiltrate information or cause a Denial of Service.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-6390
Advisory
https://www.tarlogic.com/en/blog/vulnerabilities-in-ocs-inventory-2-4-1/
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-6390		Advisory
https://www.tarlogic.com/en/blog/vulnerabilities-in-ocs-inventory-2-4-1/		x_refsource_MISCExploitThird Party Advisory