high7.5
CVE-2018-8819
An XXE issue was discovered in Automated Logic Corporation (ALC) WebCTRL Versions 6.0, 6.1 and 6.5.
Impact
An XXE issue was discovered in Automated Logic Corporation (ALC) WebCTRL Versions 6.0, 6.1 and 6.5. An unauthenticated attacker could enter malicious input to WebCTRL and a weakly configured XML parser will allow the application to disclose full file contents from the underlying web server OS via the "X-Wap-Profile" HTTP header.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Carrier | Automatedlogic Webctrl | Versions 6.0, 6.1, 6.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/148126/WebCTRL-Out-Of-Band-XML-Injection.html
- http://seclists.org/fulldisclosure/2018/Jun/21
- https://hateshape.github.io/general/2018/06/07/CVE-2018-8819.html
- http://packetstormsecurity.com/files/148126/WebCTRL-Out-Of-Band-XML-Injection.html
- http://seclists.org/fulldisclosure/2018/Jun/21
- https://hateshape.github.io/general/2018/06/07/CVE-2018-8819.html