CVE-2016-5795

Published: Aug 31, 2017Modified: May 13, 2026

7.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: NVD

Description

An XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and prior, and Carrier i-Vu Version 6.5 and prior. An attacker could enter malicious input to WebCTRL, i-Vu, or SiteScan Web through a weakly configured XML parser causing the application to execute arbitrary code or disclose file contents from a server or connected network.

Affected (3)

Products: Automatedlogic: I Vu, Sitescan Web · Carrier: Automatedlogic Webctrl

2 products

1 product

Automatedlogic Webctrl

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Automatedlogic I Vu	Up to 6.5
Automatedlogic Sitescan Web	Up to 6.5
Carrier Automatedlogic Webctrl	Up to 6.5

Related CWEs

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (4)

http://www.securityfocus.com/bid/100558

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryVDB Entry

https://ics-cert.us-cert.gov/advisories/ICSA-17-150-01

Source: ics-cert@hq.dhs.gov

MitigationThird Party AdvisoryUS Government Resource

http://www.securityfocus.com/bid/100558

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://ics-cert.us-cert.gov/advisories/ICSA-17-150-01

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party AdvisoryUS Government Resource

Timeline

No history available yet.