Description (CNA)
NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity (XXE) injection vulnerability in XML preference import settings. Attackers can craft malicious XML files with DTD parameter entities to retrieve arbitrary system files through an out-of-band channel attack.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| NovaRad Corporation / NovaPACS Diagnostics Viewer | affected 8.5.19.75 |
CWE
CWE-611
References
- https://www.exploit-db.com/exploits/45337
- https://www.novarad.net
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5488.php
ADP enrichment
No English description supplied.