CVE-2018-8940

ClientServiceConfigController.cs in Enghouse Cloud Contact Center Platform 7.2.5 has functionality for loading external XML files and parsing them, allowing an attacker to upload a malicious XML file and reference it in the URL of the application, forcing the application to load and parse the malicious XML file, aka an XXE issue.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://seclists.org/fulldisclosure/2019/May/9	Mailing List Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:enghouse:contact_center\:_service_provider:7.2.5:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-05-14 19:29

Updated : 2024-02-04 20:20

NVD link : CVE-2018-8940

Mitre link : CVE-2018-8940

CVE.ORG link : CVE-2018-8940

JSON object : View

Products Affected

enghouse

contact_center\

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2018-8940", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-05-14T19:29:00.327", "references": [{"url": "https://seclists.org/fulldisclosure/2019/May/9", "tags": ["Mailing List", "Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "ClientServiceConfigController.cs in Enghouse Cloud Contact Center Platform 7.2.5 has functionality for loading external XML files and parsing them, allowing an attacker to upload a malicious XML file and reference it in the URL of the application, forcing the application to load and parse the malicious XML file, aka an XXE issue."}, {"lang": "es", "value": "El archivo ClientServiceConfigController.cs en Enghouse Cloud Contact Center Platform versi\u00f3n 7.2.5, tiene una funcionalidad para cargar archivos XML externos y analizarlos, lo que permite a un atacante cargar un archivo XML malicioso y hacer referencia a \u00e9l en la URL de la aplicaci\u00f3n, forzando a la aplicaci\u00f3n a cargar y analizar el Archivo XML malicioso, tambi\u00e9 se conoce como un problema XXE."}], "lastModified": "2019-05-15T13:48:12.647", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:enghouse:contact_center\\:_service_provider:7.2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A53B252-FF20-4EF2-A3D3-862D4941D399"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}