XML External Entity Vulnerability in Veeam ONE by Veeam Software
CVE-2020-15418

7.5HIGH

Key Information:

Vendor
Veeam
Status
One
Vendor
CVE Published:
28 July 2020

Summary

This vulnerability affects Veeam ONE, enabling remote attackers to disclose sensitive information on impacted systems. It arises from the improper handling of XML External Entity (XXE) references in the SSRSReport class. An attacker can exploit this flaw by sending specially crafted XML documents that reference a URI, compelling the XML parser to access external content. This can lead to unauthorized disclosure of file contents within the context of the SYSTEM, potentially compromising sensitive data directly from the server.

Affected Version(s)

ONE 10.0.0.750_20200415

References

https://www.zerodayinitiative.com/advisories/ZDI-20-821/
x_refsource_MISC
https://www.veeam.com/kb3221
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

rgod
.