CVE-2018-25142

Summary

NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity (XXE) injection vulnerability in XML preference import settings. Attackers can craft malicious XML files with DTD parameter entities to retrieve arbitrary system files through an out-of-band channel attack.

Affected Software

Weaknesses

• CWE-611: Improper Restriction of XML External Entity Reference

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

Additional References

• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5488.php
• https://www.exploit-db.com/exploits/45337

References

• https://www.exploit-db.com/exploits/45337
• https://www.novarad.net
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5488.php

• ←Previous
• Next→