Vulnerabilities > CVE-2018-14473 - XXE vulnerability in Ocsinventory-Ng Ocsinventory NG 2.4.1
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
NONE Availability impact
PARTIAL Summary
OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. This issue can be exploited by an attacker sending a crafted HTTP request in order to exfiltrate information or cause a Denial of Service.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |