CVE-2018-13826

Опубликовано: 30 авг. 2018

Источник: nvd

CVSS3: 9.1

CVSS2: 6.4

EPSS Низкий

Описание

An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to conduct server side request forgery attacks.

Ссылки

http://www.securityfocus.com/bid/105297
Third Party Advisory
VDB Entry
https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html
Patch
Vendor Advisory
http://www.securityfocus.com/bid/105297
Third Party Advisory
VDB Entry
https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:broadcom:project_portfolio_management:*:*:*:*:*:*:*:*

Версия до 14.3 (включая)

cpe:2.3:a:broadcom:project_portfolio_management:14.4:*:*:*:*:*:*:*

cpe:2.3:a:broadcom:project_portfolio_management:15.1:*:*:*:*:*:*:*

cpe:2.3:a:ca:project_portfolio_management:15.2:cp5:*:*:*:*:*:*

cpe:2.3:a:ca:project_portfolio_management:15.3:cp2:*:*:*:*:*:*

EPSS

Процентиль: 60%

0.00397

Низкий

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-611

Связанные уязвимости

GHSA-84p4-qfpm-85hx