Improper XML External Entity Handling in Dell AppSync
CVE-2025-36603

4.2MEDIUM

Key Information:

Vendor

Dell
Status
Appsync
Vendor
CVE Published:
21 July 2025

What is CVE-2025-36603?

Dell AppSync version 4.6.0.0 is affected by a vulnerability that allows attackers with local access to exploit improper handling of XML External Entity (XXE) references. This flaw could result in information disclosure and unauthorized information modification, posing a significant security risk if exploited.

Affected Version(s)

AppSync NA < 4.6.0.4

References

https://www.dell.com/support/kbdoc/en-us/000345331/dsa-20...
vendor-advisory

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dell would like to thank Ouallaout Noureddine for reporting this issue
.
CVE-2025-36603 : Improper XML External Entity Handling in Dell AppSync