CVE-2018-8940 - CVE House
Back to Database
Status published Critical CVE-2018-8940

ClientServiceConfigController.cs in Enghouse Cloud Contact Center Platform 7.2.5 has functionality...

Vulnerability Description

ClientServiceConfigController.cs in Enghouse Cloud Contact Center Platform 7.2.5 has functionality for loading external XML files and parsing them, allowing an attacker to upload a malicious XML file and reference it in the URL of the application, forcing the application to load and parse the malicious XML file, aka an XXE issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-8940

Credits & Attribution

No credits recorded in the NVD database.

References

More from enghouse

View All →
CVE-2020-13972
Enghouse Web Chat 6.2.284.34 allows XSS. When one enters their...
Medium 6.1
CVE-2019-16951
A remote file include (RFI) issue was discovered in Enghouse...
Medium 5.3
CVE-2019-16950
An XSS issue was discovered in Enghouse Web Chat 6.1.300.31...
Medium 6.1
CVE-2019-16949
An issue was discovered in Enghouse Web Chat 6.1.300.31 and...
Medium 6.5
CVE-2019-16948
An SSRF issue was discovered in Enghouse Web Chat 6.1.300.31....
Critical 9.8

Affected Vendor

Affected Software

contact center\
Vulnerable Versions:
_service_provider

Timeline

Official Publish: May 14th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.