CVE-2018-1000515

Name of the Vulnerable Software and Affected Versions Ventrian News-Articles version NewsArticles.00.09.11

Description The issue is related to a XML External Entity (XXE) vulnerability in the News-Articles/API/MetaWebLog/Handler.ashx.vb file. This can allow an attacker to read any file on the server or potentially use an smbrelay attack to access the server.

Recommendations For Ventrian News-Articles version NewsArticles.00.09.11, consider disabling the Handler.ashx.vb file or restricting access to the /News-Articles/API/MetaWebLog/ endpoint until a patch is available. Additionally, restrict SMB relay attacks by implementing proper network segmentation and access controls.