Critical severity · published Dec 7, 2018
CVE-2018-15362
XXE in GE Proficy Cimplicity GDS versions 9.0 R2, 9.5, 10.0
9.1
CVSS
2.7%
EPSS
No
On KEV
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Cimplicity · GE
9.0_r2; 9.5; 10.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-15362
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-15362
Third Party Advisory
http://www.securityfocus.com/bid/106133
Mitigation
https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/07/klcert-18-025-general-electric-proficy-gds-xml-external-entity-xxe/
Mitigation
https://ics-cert.us-cert.gov/advisories/ICSA-18-340-01
More from Cimplicity
9.8
CVE-2023-3463
GE Digital CIMPLICITY Heap-based Buffer Overflow
9.8
CVE-2022-21798
ICSA-22-053-02 GE Proficy CIMPLICITY-Cleartext
7.8
CVE-2023-4487
GE Digital CIMPLICITY Process Control
7.8
CVE-2022-3092
GE CIMPLICITY Out-of-bounds Write
7.8
CVE-2022-3084
GE CIMPLICITY Access of Uninitialized Pointer