Design/Logic Flaw

2019-12-0420:15:00

PRIOn knowledge base

www.prio-n.com

6.3 Medium

AI Score

Confidence

High

0.01 Low

EPSS

Percentile

84.1%

JSON

BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. XXE with direct response and XXE OOB are allowed.

CPENameOperatorVersion
remedy_smart_reportingge9.1.03
remedy_smart_reportingle9.1.03.001
remedy_smart_reportingge9.1.04
remedy_smart_reportingle9.1.04.002
remedy_smart_reportingge18.05
remedy_smart_reportingle18.05.05
remedy_smart_reportingge19.02
remedy_smart_reportingle19.02.01

Name	Operator	Version
remedy_smart_reporting	ge	9.1.03
remedy_smart_reporting	le	9.1.03.001
remedy_smart_reporting	ge	9.1.04
remedy_smart_reporting	le	9.1.04.002
remedy_smart_reporting	ge	18.05
remedy_smart_reporting	le	18.05.05
remedy_smart_reporting	ge	19.02
remedy_smart_reporting	le	19.02.01