← Back

CVE-2018-18471

nvd nist
Published: Jun 19, 2019Modified: Nov 21, 2024

JSON object

Loading...
9.8
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

/api/2.0/rest/aggregator/xml in Axentra firmware, used by NETGEAR Stora, Seagate GoFlex Home, and MEDION LifeCloud, has an XXE vulnerability that can be chained with an SSRF bug to gain remote command execution as root. It can be triggered by anyone who knows the IP address of the affected device.

Affected (1)

Products: Axentra: Hipserv
Axentra
1 product
Hipserv
Configuration A
1 vulnerable · 3 platform
Vulnerable SoftwareAffected Versions
Hipserv
All versions
Running on/withPlatform Versions
Medion
Lifecloud
All versions
Netgear
Stora
All versions
Seagate
Goflex Home
All versions

Related CWEs

CWE-611
Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (4)

Source: cve@mitre.org
Vendor AdvisoryURL Repurposed
Source: cve@mitre.org
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor AdvisoryURL Repurposed
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory

Timeline

No history available yet.