Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 contain a XML External Entity (XXE) Injection vulnerability in the REST API. An authenticated remote malicious user could potentially exploit this vulnerability to read certain system files in the server or cause denial of service by supplying specially crafted Document Type Definitions (DTDs) in an XML request.
References
| Link | Resource |
|---|---|
| http://seclists.org/fulldisclosure/2018/Aug/5 | Mailing List Third Party Advisory |
| http://www.securityfocus.com/bid/105130 | Third Party Advisory VDB Entry |
| http://www.securitytracker.com/id/1041417 | Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2018/Aug/5 | Mailing List Third Party Advisory |
| http://www.securityfocus.com/bid/105130 | Third Party Advisory VDB Entry |
| http://www.securitytracker.com/id/1041417 | Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 03:42
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://seclists.org/fulldisclosure/2018/Aug/5 - Mailing List, Third Party Advisory | |
| References | () http://www.securityfocus.com/bid/105130 - Third Party Advisory, VDB Entry | |
| References | () http://www.securitytracker.com/id/1041417 - Third Party Advisory, VDB Entry |
Information
Published : 2018-08-10 20:29
Updated : 2024-11-21 03:42
NVD link : CVE-2018-11048
Mitre link : CVE-2018-11048
CVE.ORG link : CVE-2018-11048
JSON object : View
Products Affected
dell
- emc_integrated_data_protection_appliance
- emc_data_protection_advisor
CWE
CWE-611
Improper Restriction of XML External Entity Reference