CVE-2019-16188 - CVE House
Back to Database
Status published High CVE-2019-16188

HCL AppScan Source before 9.03.13 is susceptible to XML External...

Vulnerability Description

HCL AppScan Source before 9.03.13 is susceptible to XML External Entity (XXE) attacks in multiple locations. In particular, an attacker can send a specially crafted .ozasmt file to a targeted victim and ask the victim to open it. When the victim imports the .ozasmt file in AppScan Source, the content of any file in the local file system (to which the victim as read access) can be exfiltrated to a remote listener under the attacker's control. The product does not disable external XML Entity Processing, which can lead to information disclosure and denial of services attacks.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-16188

Credits & Attribution

No credits recorded in the NVD database.

References

More from hcltech

View All →
CVE-2018-11518
A vulnerability allows a phreaking attack on HCL legacy IVR...
High 8.1

Affected Vendor

Affected Software

appscan source
Vulnerable Versions:
0

Timeline

Official Publish: September 25th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.