XXE attack in MDS PulseNET Enterprise and GE MDS PulseNET - CVE-2018-10613

Vulnerability identifier: #VU13123

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-10613

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated attacker to perform XXE attack on the target system.

The weakness exists due to insufficient validation for external entities. A remote attacker can supply data containing an XML external entities, perform multiple variants of XXE attacks and exfiltrate data from the host Windows platform.

MDS PulseNET Enterprise
GE MDS PulseNET
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Opensuse

Install update from vendor's website.

• https://ics-cert.us-cert.gov/advisories/ICSA-18-151-02

• Multiple vulnerabilities in GE MDS PulseNET and MDS PulseNET Enterprise
• OpenSUSE Linux update for python3
• Red Hat update for python