CVE-2019-11216 - BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality

Back Back to CVE browser

MEDIUM

BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality

Published Dec 4, 2019

6.5

MEDIUM

CVSS 3.1

EPSS 1.84%

Description

BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. XXE with direct response and XXE OOB are allowed.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-434

Unrestricted Upload of File

CWE-611

XXE

References (3)

http://packetstormsecurity.com/files/155552/BMC-Smart-Reporting-7.3-20180418-XML-Injection.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Dec/7
x_refsource_MISCExploitMailing ListThird Party Advisory
https://docs.bmc.com/docs/itsm90/export-and-import-repository-509983929.html
x_refsource_MISCProduct

Link	Providers	Tags
http://packetstormsecurity.com/files/155552/BMC-Smart-Reporting-7.3-20180418-XML-Injection.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Dec/7		x_refsource_MISCExploitMailing ListThird Party Advisory
https://docs.bmc.com/docs/itsm90/export-and-import-repository-509983929.html		x_refsource_MISCProduct