Vulnerabilities > CVE-2018-18659 - XXE vulnerability in Arcserve UDP 6.0/6.5
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-19 Unauthenticated XXE in /management/UdpHttpService issue.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 9 |
Common Weakness Enumeration (CWE)
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/152033
- https://support.arcserve.com/s/article/360001392563?language=en_US
- https://support.arcserve.com/s/article/360001392563?language=en_US
- https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UDP-and-fixes-for-them?language=en_US
- https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UDP-and-fixes-for-them?language=en_US
- https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/
- https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/