Determine Contract Lifecycle Management XML External Entity Injection Vulnerability

Determine Contract Lifecycle Management CLM is a suite of enterprise contract lifecycle management solutions from Determine Corporation. An XML external entity injection vulnerability exists in the definitionuploadattach.jsp file in Determine CLM version 5.4, which can be exploited by an attacker...

CVE-2019-20153: Improper Restriction of XML External Entity Reference

An issue was discovered in Determine formerly Selectica Contract Lifecycle Management CLM in v5.4. An XML external entity XXE vulnerability in the upload definition feature in definitionuploadattach.jsp allows authenticated remote attackers to read arbitrary files including configuration files...