XML External Entity Injection in Solid Edge SE2021 by Siemens
CVE-2021-37178

5.5MEDIUM

Key Information:

Vendor
Siemens
Status
Solid Edge Se2021
Vendor
CVE Published:
10 August 2021

Summary

A vulnerability discovered in Solid Edge SE2021 could allow remote attackers to exploit the XML parser, potentially disclosing sensitive files. This occurs due to an XML external entity injection that enables attackers to load malicious XML files, leading to unauthorized access to files within the affected application.

Affected Version(s)

Solid Edge SE2021 All Versions < SE2021MP7

References

https://cert-portal.siemens.com/productcert/pdf/ssa-81868...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.