High severity · published Aug 10, 2018
CVE-2018-11048
Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 contain a XML External Entity (XXE)…
8.1
CVSS
2.1%
EPSS
No
On KEV
Description
Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 contain a XML External Entity (XXE) Injection vulnerability in the REST API. An authenticated remote malicious user could potentially exploit this vulnerability to read certain system files in the server or cause denial of service by supplying specially crafted Document Type Definitions (DTDs) in an XML request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DP
Data Protection Advisor · Dell EMC
6.2; 6.3; 6.4 through patch B180; 6.5 through patch B58 · source: vendor
ID
Integrated Data Protection Appliance · Dell EMC
2.0; 2.1 · source: vendor
ED
Emc Data Protection Advisor · Dell
6.2; 6.3; 6.4; 6.5 · source: NVD
EI
Emc Integrated Data Protection Appliance · Dell
2.0; 2.1 · source: NVD