Login Request a demo
High severity · published Jun 14, 2018
CVE-2018-8819
An XXE issue was discovered in Automated Logic Corporation (ALC) WebCTRL Versions 6.0, 6.1 and 6.5
7.5
CVSS
2.9%
EPSS
No
On KEV
Description
An XXE issue was discovered in Automated Logic Corporation (ALC) WebCTRL Versions 6.0, 6.1 and 6.5. An unauthenticated attacker could enter malicious input to WebCTRL and a weakly configured XML parser will allow the application to disclose full file contents from the underlying web server OS via the "X-Wap-Profile" HTTP header.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AW
Automatedlogic Webctrl · Carrier
6.0; 6.1; 6.5 · source: NVD
Affected product
AW
Automatedlogic Webctrl
Carrier
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-8819
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-8819
Third Party Advisory
http://packetstormsecurity.com/files/148126/WebCTRL-Out-Of-Band-XML-Injection.html
Mailing List
http://seclists.org/fulldisclosure/2018/Jun/21
Exploit
https://hateshape.github.io/general/2018/06/07/CVE-2018-8819.html
More from Automatedlogic Webctrl
7.8
CVE-2017-9650
An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan…
7.3
CVE-2016-5795
An XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and prior, and Carrier i-Vu Version 6.5 and…
7.0
CVE-2017-9644
An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and…
6.3
CVE-2017-9640
A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu…