#VU13801 XXE attack in SEL AcSELerator Architect and SEL Compass - CVE-2018-10600

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU13801

#VU13801 XXE attack in SEL AcSELerator Architect and SEL Compass - CVE-2018-10600

Published: July 11, 2018


Vulnerability identifier: #VU13801
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-10600
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
SEL AcSELerator Architect
SEL Compass
Software vendor:
Schweitzer Engineering Laboratories, Inc.

Description

The vulnerability allows a remote attacker to conduct XXE attack on the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the AcSELerator Architect XML parser, conduct XXE attack and retrieve arbitrary data or cause the service to crash.


Remediation

Update SEL Compass to version 5.0.6.0 or later.
Update SEL AcSELerator  to version 2.2.28.0.


External links