Intersystems Cache XXE Vulnerability Discovered
CVE-2018-17152

6.4MEDIUM

Key Information:

Vendor

Intersystems

Status
Cache
Vendor
CVE Published:
11 July 2019

What is CVE-2018-17152?

Intersystems Cache versions, specifically 2017.2.2.865.0, are susceptible to XML External Entity (XXE) attacks, which can allow an attacker to interfere with an application’s processing of XML data. Utilizing an XXE vulnerability, malicious XML input can lead to sensitive information disclosure, server-side request forgery (SSRF), and potentially impact the confidentiality and availability of the system.

References

https://know.bishopfox.com/advisories/intersystems-cache-...
x_refsource_MISC

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.