CVE-2018-14473

{"id": "CVE-2018-14473", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2018-08-04T01:29:03.873", "references": [{"url": "https://www.tarlogic.com/en/blog/vulnerabilities-in-ocs-inventory-2-4-1/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. This issue can be exploited by an attacker sending a crafted HTTP request in order to exfiltrate information or cause a Denial of Service."}, {"lang": "es", "value": "OCS Inventory 2.4.1 carece de una configuraci\u00f3n de an\u00e1lisis XML adecuada, lo que permite el uso de entidades externas. Este problema puede ser explotado por un atacante que env\u00ede una petici\u00f3n HTTP manipulada para exfiltrar informaci\u00f3n o provocar una denegaci\u00f3n de servicio (DoS)."}], "lastModified": "2018-10-01T01:54:04.663", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ocsinventory-ng:ocsinventory_ng:2.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3D06DF4-B439-41B8-A2A7-4CB4DBAF46AB"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}