Description (CNA)
EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, as demonstrated by reading the /etc/shadow file.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html
- https://gist.github.com/brandonprry/9895721
- http://seclists.org/fulldisclosure/2014/Mar/426
ADP enrichment
No English description supplied.