An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that contains malicious XML DTD data.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCipplanner Cipace
APPCipplanner< 9.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth BypassXXE
CWE
Related vulnerabilities
CVE-2020-11598CRITICAL9.8ten sam produkt
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. Upload.ashx allows remote attackers to exec...
CVE-2020-11597CRITICAL9.8ten sam produkt
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTT...
CVE-2024-50619HIGH8.8ten sam produkt
Vulnerabilities in the My Account and User Management components in CIPPlanner CIPAce before 9.17 allows attac...
CVE-2024-50617HIGH7.5ten sam produkt
Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow at...
CVE-2024-50620HIGH8.8ten sam produkt
Unrestricted Upload of File with Dangerous Type vulnerabilities exist in the rich text editor and document man...