Vulnerabilities > CVE-2017-13706 - XXE vulnerability in Lansweeper

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

SINGLE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

low complexity

lansweeper

CWE-611

NVD

Published: 2017-10-10

Updated: 2017-11-05

Summary

XML external entity (XXE) vulnerability in the import package functionality of the deployment module in Lansweeper before 6.0.100.67 allows remote authenticated users to obtain sensitive information, cause a denial of service, conduct server-side request forgery (SSRF) attacks, conduct internal port scans, or have unspecified other impact via an XML request, aka bug #572705.

Vulnerable Configurations

Part	Description	Count
Application	Lansweeper Lansweeper Lansweeper 3.5 Lansweeper Lansweeper 3.5.1 Lansweeper Lansweeper 3.5.2 Lansweeper Lansweeper 4.0 Lansweeper Lansweeper 4.0.0.24 Lansweeper Lansweeper 4.0.0.27 Lansweeper Lansweeper 4.0.0.36 Lansweeper Lansweeper 4.0.0.37 Lansweeper Lansweeper 4.0.0.40 Lansweeper Lansweeper 4.0.0.41 Lansweeper Lansweeper 4.0.0.42 Lansweeper Lansweeper 4.0.0.106 Lansweeper Lansweeper 4.1.0.11 Lansweeper Lansweeper 4.1.0.12 Lansweeper Lansweeper 4.1.0.14 Lansweeper Lansweeper 4.1.0.16 Lansweeper Lansweeper 4.1.0.18 Lansweeper Lansweeper 4.1.0.21 Lansweeper Lansweeper 4.1.0.27 Lansweeper Lansweeper 4.1.0.29 Lansweeper Lansweeper 4.1.0.35 Lansweeper Lansweeper 4.2.0.52 Lansweeper Lansweeper 4.2.0.54 Lansweeper Lansweeper 4.2.0.60 Lansweeper Lansweeper 4.2.0.63 Lansweeper Lansweeper 4.2.0.68 Lansweeper Lansweeper 4.2.0.70 Lansweeper Lansweeper 4.2.0.77 Lansweeper Lansweeper 4.2.0.82 Lansweeper Lansweeper 4.2.0.86 Lansweeper Lansweeper 4.2.0.90 Lansweeper Lansweeper 5.0 Lansweeper Lansweeper 5.0.0.44 Lansweeper Lansweeper 5.0.0.48 Lansweeper Lansweeper 5.0.0.52 Lansweeper Lansweeper 5.0.0.60 Lansweeper Lansweeper 5.0.0.69 Lansweeper Lansweeper 5.0.0.76 Lansweeper Lansweeper 5.0.0.77 Lansweeper Lansweeper 5.0.0.78 Lansweeper Lansweeper 5.0.0.79 Lansweeper Lansweeper 5.0.0.81 Lansweeper Lansweeper 5.1.0.28 Lansweeper Lansweeper 5.1.0.29 Lansweeper Lansweeper 5.1.0.31 Lansweeper Lansweeper 5.1.0.45 Lansweeper Lansweeper 5.1.0.49 Lansweeper Lansweeper 5.1.0.50 Lansweeper Lansweeper 5.1.0.53 Lansweeper Lansweeper 5.1.0.54 Lansweeper Lansweeper 5.1.0.55 Lansweeper Lansweeper 5.1.0.59 Lansweeper Lansweeper 5.1.0.60 Lansweeper Lansweeper 5.1.0.61 Lansweeper Lansweeper 5.1.0.62 Lansweeper Lansweeper 5.1.0.63 Lansweeper Lansweeper 5.1.0.64 Lansweeper Lansweeper 5.1.0.65 Lansweeper Lansweeper 5.1.0.66 Lansweeper Lansweeper 5.2.0.15 Lansweeper Lansweeper 5.2.0.17 Lansweeper Lansweeper 5.2.0.22 Lansweeper Lansweeper 5.2.0.24 Lansweeper Lansweeper 5.2.0.27 Lansweeper Lansweeper 5.2.0.30 Lansweeper Lansweeper 5.2.0.31 Lansweeper Lansweeper 5.2.0.33 Lansweeper Lansweeper 5.2.0.41 Lansweeper Lansweeper 5.2.0.42 Lansweeper Lansweeper 5.2.0.43 Lansweeper Lansweeper 5.3.0.5 Lansweeper Lansweeper 5.3.0.6 Lansweeper Lansweeper 5.3.0.8 Lansweeper Lansweeper 5.3.0.12 Lansweeper Lansweeper 5.3.0.13 Lansweeper Lansweeper 5.3.0.15 Lansweeper Lansweeper 5.3.0.17 Lansweeper Lansweeper 5.3.0.21 Lansweeper Lansweeper 5.3.0.22 Lansweeper Lansweeper 5.3.0.24 Lansweeper Lansweeper 5.3.0.25 Lansweeper Lansweeper 5.3.0.28 Lansweeper Lansweeper 5.3.0.30 Lansweeper Lansweeper 5.3.0.31 Lansweeper Lansweeper 5.3.0.32 Lansweeper Lansweeper 5.3.0.33 Lansweeper Lansweeper 5.3.0.34 Lansweeper Lansweeper 6.0.0.19 Lansweeper Lansweeper 6.0.0.22 Lansweeper Lansweeper 6.0.0.42 Lansweeper Lansweeper 6.0.0.45 Lansweeper Lansweeper 6.0.0.48 Lansweeper Lansweeper 6.0.0.51 Lansweeper Lansweeper 6.0.0.63 Lansweeper Lansweeper 6.0.0.64 Lansweeper Lansweeper 6.0.0.65 Lansweeper Lansweeper 6.0.100.12 Lansweeper Lansweeper 6.0.100.21 Lansweeper Lansweeper 6.0.100.29	99

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Packetstorm

data source	https://packetstormsecurity.com/files/download/144527/lansweeper-xxe.txt
id	PACKETSTORM:144527
last seen	2017-10-08
published	2017-10-06
reporter	Mehmet Ince
source	https://packetstormsecurity.com/files/144527/Lansweeper-6.0.100.29-XXE-Injection.html
title	Lansweeper 6.0.100.29 XXE Injection

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Packetstorm

References