XML External Entity (XXE) Injection Vulnerability
CVE-2019-3722

7.5HIGH

Key Information:

Vendor
Dell
Status
Openmanage Server Administrator
Vendor
CVE Published:
6 June 2019

Summary

Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external entity (XXE) injection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to read arbitrary server system files by supplying specially crafted document type definitions (DTDs) in an XML request.

Affected Version(s)

OpenManage Server Administrator 9.1.0.3

OpenManage Server Administrator 9.3.0.4

References

https://www.dell.com/support/article/us/en/04/sln317441/d...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/108685
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.