Vulnerabilities > CVE-2018-13826 - XXE vulnerability in multiple products

CVSS 9.1 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

broadcom

CWE-611

critical

NVD

Published: 2018-08-30

Updated: 2024-11-21

Summary

An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to conduct server side request forgery attacks.

Vulnerable Configurations

Part	Description	Count
Application	Ca CA Project Portfolio Management 15.3 CA Project Portfolio Management 15.2	2
Application	Broadcom Broadcom Project Portfolio Management 15.1 Broadcom Project Portfolio Management 14.4 Broadcom Project Portfolio Management 14.2 Broadcom Project Portfolio Management 14.3	4

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

References

http://www.securityfocus.com/bid/105297
http://www.securityfocus.com/bid/105297
https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html
https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html