CVE-2021-44477

GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-025-01	Mitigation Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:ge:toolboxst:*:*:*:*:*:*:*:*

History

04 Apr 2022, 14:30

Type	Values Removed	Values Added
CPE		cpe:2.3:a:ge:toolboxst::::::::
CWE		CWE-611
First Time		Ge toolboxst Ge
References	~~(CONFIRM) https://www.cisa.gov/uscert/ics/advisories/icsa-22-025-01 -~~	(CONFIRM) https://www.cisa.gov/uscert/ics/advisories/icsa-22-025-01 - Mitigation, Third Party Advisory, US Government Resource
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 5.0 v3 : 7.5

25 Mar 2022, 19:44

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-03-25 19:15

Updated : 2023-12-10 14:22

NVD link : CVE-2021-44477

Mitre link : CVE-2021-44477

CVE.ORG link : CVE-2021-44477

JSON object : View

Products Affected

ge

toolboxst

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2021-44477", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-03-25T19:15:09.433", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-025-01", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file."}, {"lang": "es", "value": "GE Gas Power ToolBoxST Versi\u00f3n v04.07.05C, sufre una vulnerabilidad de tipo XML external entity (XXE) usando la t\u00e9cnica de entidades de par\u00e1metros DTD que podr\u00eda resultar en una divulgaci\u00f3n y recuperaci\u00f3n de datos arbitrarios en el nodo afectado por medio de un ataque fuera de banda (OOB). La vulnerabilidad es desencadenada cuando la entrada que es pasada al analizador XML no es saneada mientras es analizado el archivo de proyecto/plantilla XML"}], "lastModified": "2022-04-04T14:30:52.257", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ge:toolboxst:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E124D2FA-3D75-4461-8E7B-2DB6FB2B0262", "versionEndExcluding": "07.09.07c"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}