PT-2017-3003
CVE-2017-14759
·
تاريخ النشر
2017-09-27
·
تاريخ التحديث
2017-10-11
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13
Description
The issue is caused by an XML External Entity vulnerability. An unauthenticated user can exploit this to read directory listings or system files, or cause Server-Side Request Forgery (SSRF) or Denial of Service. The vulnerability is associated with the /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/ endpoint.
Recommendations
For versions prior to v4.5SP1 Patch 13, update to v4.5SP1 Patch 13 or later to resolve the issue.
As a temporary workaround, consider restricting access to the /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/ endpoint until a patch is applied.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾