Xxe

2020-01-0523:15:00

PRIOn knowledge base

www.prio-n.com

5.2 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.1%

JSON

An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) in v5.4. An XML external entity (XXE) vulnerability in the upload definition feature in definition_upload_attach.jsp allows authenticated remote attackers to read arbitrary files (including configuration files containing administrative credentials).

CPENameOperatorVersion
contract_lifecycle_managementeq5.4

CPE	Name	Operator	Version
	contract_lifecycle_management	eq	5.4

References

www.n00py.io/2020/01/zero-day-exploit-in-determine-selectica-contract-lifecycle-management-sclm-v5-4/