CVE-2020-27858

CVE-2020-27858 affects CA Arcserve D2D 16.5. A flaw in the getNews method arises from improper restriction of XML External Entity (XXE) references, allowing remote attackers to disclose sensitive information in the context of SYSTEM without authentication. The exploitation path is via a crafted X...