PT-2022-02: XML External Entity (XXE)

Nokia

Vulnerable software

NetAct v 20.1

Severity level

Severity level: Medium
Impact: XML External Entity (XXE)
Access Vector: Remote

CVSS v3.1
Base Score: 5,8
Vector: (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/MAV:L/MAC:H/MPR:L/MUI:N/MS:U/MC:H/MI:L/MA:L)

CVE-2023-26058

Vulnerability description:

Input validation and proper XML parsers configuration was missing. On the Perfomance Manager+ page, attackers can import XML files. Support of external entities is enabled for processing of such files, which leads to Arbitrary File Read and SSRF. The attack can only be performed by an internal user. The vulnerability is fixed in NetAct 22 FP2211 and onwards.

Advisory status

10.10.2022 - Vendor gets vulnerability details

Credits

The vulnerability was detected by Vladimir Razov and Aleksandr Ustinov (Positive Technologies)