CVE-2020-12684 Information

Description

XXE injection can occur in i-net Clear Reports 2019 19.0.287 (Designer) as used in i-net HelpDesk and other products when XML input containing a reference to an external entity is processed by a weakly configured XML parser.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

https://www.inetsoftware.de/documentation/clear-reports/release-notes/releases https://www.inetsoftware.de/documentation/clear-reports/release-notes/releases/changes_20.4

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

9.8