#VU12275 XXE attack in EMC ViPR SRM

Vulnerability identifier: #VU12275

Vulnerability risk: Low

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: N/A

CWE-ID: CWE-611

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
EMC ViPR SRM
Client/Desktop applications / Software for archiving

Vendor: Dell

Description
The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The weakness exists due to improper restriction of XML external entity reference. A remote attacker can cause the service to crash, conduct XML external entity attacks to obtain files and gain root privileges.

Mitigation
Update to version 4.1.1.

Vulnerable software versions

EMC ViPR SRM: 4.1

---

External links
https://seclists.org/fulldisclosure/2018/Apr/54

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.