Vulnerabilities > CVE-2018-13823 - XXE vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

broadcom

CWE-611

NVD

Published: 2018-08-30

Updated: 2024-11-21

Summary

An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to access sensitive information.

Vulnerable Configurations

Part	Description	Count
Application	Ca CA Project Portfolio Management 15.3 CA Project Portfolio Management 15.2	2
Application	Broadcom Broadcom Project Portfolio Management 15.1 Broadcom Project Portfolio Management 14.4 Broadcom Project Portfolio Management 14.2 Broadcom Project Portfolio Management 14.3	4

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

References

http://www.securityfocus.com/bid/105297
http://www.securityfocus.com/bid/105297
https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html
https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html