Vulnerabilities > CVE-2017-13706 - XXE vulnerability in Lansweeper

CVSS 9.9 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

lansweeper

CWE-611

critical

NVD

Published: 2017-10-10

Updated: 2017-11-05

Summary

XML external entity (XXE) vulnerability in the import package functionality of the deployment module in Lansweeper before 6.0.100.67 allows remote authenticated users to obtain sensitive information, cause a denial of service, conduct server-side request forgery (SSRF) attacks, conduct internal port scans, or have unspecified other impact via an XML request, aka bug #572705.

Vulnerable Configurations

Part	Description	Count
Application	Lansweeper Lansweeper Lansweeper 3.5 Lansweeper Lansweeper 3.5.1 Lansweeper Lansweeper 3.5.2 Lansweeper Lansweeper 4.0 Lansweeper Lansweeper 4.0.0.24 Lansweeper Lansweeper 4.0.0.27 Lansweeper Lansweeper 4.0.0.36 Lansweeper Lansweeper 4.0.0.37 Lansweeper Lansweeper 4.0.0.40 Lansweeper Lansweeper 4.0.0.41 Lansweeper Lansweeper 4.0.0.42 Lansweeper Lansweeper 4.0.0.106 Lansweeper Lansweeper 4.1.0.11 Lansweeper Lansweeper 4.1.0.12 Lansweeper Lansweeper 4.1.0.14 Lansweeper Lansweeper 4.1.0.16 Lansweeper Lansweeper 4.1.0.18 Lansweeper Lansweeper 4.1.0.21 Lansweeper Lansweeper 4.1.0.27 Lansweeper Lansweeper 4.1.0.29 Lansweeper Lansweeper 4.1.0.35 Lansweeper Lansweeper 4.1.0.113 Lansweeper Lansweeper 4.1.0.117 Lansweeper Lansweeper 4.1.0.121 Lansweeper Lansweeper 4.1.0.127 Lansweeper Lansweeper 4.2.0.52 Lansweeper Lansweeper 4.2.0.54 Lansweeper Lansweeper 4.2.0.60 Lansweeper Lansweeper 4.2.0.63 Lansweeper Lansweeper 4.2.0.68 Lansweeper Lansweeper 4.2.0.70 Lansweeper Lansweeper 4.2.0.77 Lansweeper Lansweeper 4.2.0.82 Lansweeper Lansweeper 4.2.0.86 Lansweeper Lansweeper 4.2.0.90 Lansweeper Lansweeper 5.0 Lansweeper Lansweeper 5.0.0.27 Lansweeper Lansweeper 5.0.0.44 Lansweeper Lansweeper 5.0.0.48 Lansweeper Lansweeper 5.0.0.49 Lansweeper Lansweeper 5.0.0.52 Lansweeper Lansweeper 5.0.0.60 Lansweeper Lansweeper 5.0.0.69 Lansweeper Lansweeper 5.0.0.76 Lansweeper Lansweeper 5.0.0.77 Lansweeper Lansweeper 5.0.0.78 Lansweeper Lansweeper 5.0.0.79 Lansweeper Lansweeper 5.0.0.81 Lansweeper Lansweeper 5.1.0.28 Lansweeper Lansweeper 5.1.0.29 Lansweeper Lansweeper 5.1.0.31 Lansweeper Lansweeper 5.1.0.45 Lansweeper Lansweeper 5.1.0.49 Lansweeper Lansweeper 5.1.0.50 Lansweeper Lansweeper 5.1.0.53 Lansweeper Lansweeper 5.1.0.54 Lansweeper Lansweeper 5.1.0.55 Lansweeper Lansweeper 5.1.0.59 Lansweeper Lansweeper 5.1.0.60 Lansweeper Lansweeper 5.1.0.61 Lansweeper Lansweeper 5.1.0.62 Lansweeper Lansweeper 5.1.0.63 Lansweeper Lansweeper 5.1.0.64 Lansweeper Lansweeper 5.1.0.65 Lansweeper Lansweeper 5.1.0.66 Lansweeper Lansweeper 5.2.0.15 Lansweeper Lansweeper 5.2.0.17 Lansweeper Lansweeper 5.2.0.22 Lansweeper Lansweeper 5.2.0.24 Lansweeper Lansweeper 5.2.0.27 Lansweeper Lansweeper 5.2.0.30 Lansweeper Lansweeper 5.2.0.31 Lansweeper Lansweeper 5.2.0.33 Lansweeper Lansweeper 5.2.0.41 Lansweeper Lansweeper 5.2.0.42 Lansweeper Lansweeper 5.2.0.43 Lansweeper Lansweeper 5.3.0.5 Lansweeper Lansweeper 5.3.0.6 Lansweeper Lansweeper 5.3.0.8 Lansweeper Lansweeper 5.3.0.12 Lansweeper Lansweeper 5.3.0.13 Lansweeper Lansweeper 5.3.0.15 Lansweeper Lansweeper 5.3.0.17 Lansweeper Lansweeper 5.3.0.21 Lansweeper Lansweeper 5.3.0.22 Lansweeper Lansweeper 5.3.0.24 Lansweeper Lansweeper 5.3.0.25 Lansweeper Lansweeper 5.3.0.28 Lansweeper Lansweeper 5.3.0.30 Lansweeper Lansweeper 5.3.0.31 Lansweeper Lansweeper 5.3.0.32 Lansweeper Lansweeper 5.3.0.33 Lansweeper Lansweeper 5.3.0.34 Lansweeper Lansweeper 6.0.0.19 Lansweeper Lansweeper 6.0.0.22 Lansweeper Lansweeper 6.0.0.42 Lansweeper Lansweeper 6.0.0.45 Lansweeper Lansweeper 6.0.0.48 Lansweeper Lansweeper 6.0.0.51 Lansweeper Lansweeper 6.0.0.63 Lansweeper Lansweeper 6.0.0.64 Lansweeper Lansweeper 6.0.0.65 Lansweeper Lansweeper 6.0.0.6517 Lansweeper Lansweeper 6.0.100.12 Lansweeper Lansweeper 6.0.100.21 Lansweeper Lansweeper 6.0.100.29	106

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Packetstorm

data source	https://packetstormsecurity.com/files/download/144527/lansweeper-xxe.txt
id	PACKETSTORM:144527
last seen	2017-10-08
published	2017-10-06
reporter	Mehmet Ince
source	https://packetstormsecurity.com/files/144527/Lansweeper-6.0.100.29-XXE-Injection.html
title	Lansweeper 6.0.100.29 XXE Injection

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Packetstorm

References