XXE attack in EMC Data Protection Advisor - CVE-2018-11048
Published: August 3, 2018 / Updated: August 6, 2018
Vulnerability identifier: #VU14192
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-11048
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to perform XXE attack.
The weakness exists due to an error when processing malicious XML data. A remote attacker can supply specially crafted XML External Entity (XXE) data to the target REST API to read files on the target system with elevated privileges or cause the service to crash.
Affected software
EMC Data Protection Advisor
How to mitigate CVE-2018-11048
The vulnerability has been fixed in the versions 6.4 patch B180, 6.5 patch B58.
EMC Data Protection Advisor - addressed in versions 6.4 patch B180, 6.5 patch B58