Published: 12/07/2018 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Subscribe to Fortify Software Security Center

An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
hp fortify software security center 18.1
hp fortify software security center 17.2
hp fortify software security center 17.1

Details ================ Software: Fortify SSC (Software Security Center) Version: 1710, 1720 & 1810 Homepage: wwwmicrofocuscom Advisory report: githubcom/alt3kx/CVE-2018-12463 CVE: CVE-2018-12463 at cvemitreorg/cgi-bin/cvenamecgi?name=CVE-2018-12463 CVSS: HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) CWE-611, CWE ...

Fortify SSC versions 1710, 1720, and 1810 suffer from an out-of-band XML external entity injection vulnerability ...

XML external entity (XXE) vulnerability in /ssc/fm-ws/services in Fortify Software Security Center (SSC) 17.10, 17.20 & 18.10 (0day CVE-2018-12463)

CVE-2018-12463 XML external entity (XXE) vulnerability in /ssc/fm-ws/services in Fortify Software Security Center (SSC) 1710, 1720 & 1810 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request Exploit-DB publication at wwwexploit-dbcom/exploits/45027/ PacketSto

CWE-611 http://www.securitytracker.com/id/1041286 https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03201563 https://www.exploit-db.com/exploits/45027/https://nvd.nist.gov https://github.com/alt3kx/CVE-2018-12463 https://www.exploit-db.com/exploits/45027/

CVE-2018-12463

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect