CyberPower Systems PowerPanel 3.1.2 XXE Out-Of-Band Data Retrieval
Posted by deepcore on July 10, 2016 – 2:41 am
CyberPower Systems PowerPanel version 3.1.2 suffers from an unauthenticated XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xmlservice servlet using the ppbe.xml script is not sanitized while parsing the xml inquiry payload returned by the JAXB element translation.
Post a reply
You must be logged in to post a comment.