medium6.5Public exploit code
CVE-2018-19371
The SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that allows reading sensitive files from the system.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SDL Web Content Manager 8.5.0 - XML External Entity Injection2018-12-18 · webapps · xml
Impact
The SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that allows reading sensitive files from the system.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sdl | Web Content Manager | Version 8.5.0 |