CVE-2018-16792

Published: Dec 5, 2018Modified: Nov 21, 2024

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate data.

Affected (1)

Products: Solarwinds: Sftp/scp Server

Solarwinds

1 product

Sftp/scp Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Solarwinds Sftp/scp Server	Up to 2018-09-10

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

https://seclists.org/fulldisclosure/2018/Dec/0

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://seclists.org/fulldisclosure/2018/Dec/0

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.