Lucene search

DellCVELIST:CVE-2019-3752

HistoryJul 16, 2021 - 9:20 p.m.

CVE-2019-3752

2021-07-1621:20:09

CWE-611

dell

www.cve.org

dell emc

avamar server

integrated data protection appliance

xml external entity

injection

vulnerability

denial of service

information exposure

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

38.9%

JSON

Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, 2.2, 2.3 and 2.4. contain an XML External Entity(XXE) Injection vulnerability. A remote unauthenticated malicious user could potentially exploit this vulnerability to cause Denial of Service or information exposure by supplying specially crafted document type definitions (DTDs) in an XML request.

CNA Affected

[
  {
    "product": "Avamar",
    "vendor": "Dell",
    "versions": [
      {
        "status": "affected",
        "version": "7.4.1, 7.5.0, 7.5.1, 18.2"
      }
    ]
  }
]

References

www.dell.com/support/security/en-us/details/537853/DSA-2019-119-Dell-EMC-Avamar-XML-External-Entity-Injection-Vulnerability

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

38.9%

JSON

Related for CVELIST:CVE-2019-3752