Vulnerabilities > CVE-2018-10832 - XXE vulnerability in Modbuspal Project Modbuspal 1.6
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
NONE Availability impact
NONE Summary
ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack. Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML-based, which are vulnerable to XXE injection. Sending a crafted .xmpp or .xmpa file to a user, when opened/imported in ModbusPal, will return the contents of any local files to a remote attacker.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Common Weakness Enumeration (CWE)
Exploit-Db
| description | ModbusPal 1.6b - XML External Entity Injection. CVE-2018-10832. Webapps exploit for Java platform |
| file | exploits/java/webapps/44607.txt |
| id | EDB-ID:44607 |
| last seen | 2018-05-24 |
| modified | 2018-05-10 |
| platform | java |
| port | |
| published | 2018-05-10 |
| reporter | Exploit-DB |
| source | https://www.exploit-db.com/download/44607/ |
| title | ModbusPal 1.6b - XML External Entity Injection |
| type | webapps |
Packetstorm
| data source | https://packetstormsecurity.com/files/download/147573/modbupal16b-xxe.txt |
| id | PACKETSTORM:147573 |
| last seen | 2018-05-10 |
| published | 2018-05-10 |
| reporter | Trent Gordon |
| source | https://packetstormsecurity.com/files/147573/ModbusPal-1.6b-XML-External-Entity-Injection.html |
| title | ModbusPal 1.6b XML External Entity Injection |